CVE-2026-98051
kernel: net: bcmasp: fix tx_spb_ring_full() checking same slot cnt times
Severity
ModerateRed Hat Product Security
CVSS 3.1
Review impact separately from score.
Published · September 25, 2026
Updated · October 7, 2026
Description
A flaw was found in the Linux kernel's Broadcom ASP 2.0 Ethernet driver. When evaluating whether sufficient transmit buffer space is available for outgoing packets, the driver fails to properly verify all required consecutive descriptor slots. A local user could exploit this flaw by generating network traffic under heavy queue load, causing the driver to transmit data into already occupied slots. This issue can lead to buffer corruption, driver failure, and a denial of service (DoS).
CVSS score applicability
The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.
Mitigation
No mitigation is specified in collected source.
CVSS / CWE
CVSS 3.1 · 5.5CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CWE-120 · Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')