Critical 9.8Published Jun 24, 2026

CVE-2026-53086net: bcmgenet: fix racing timeout handler

Updated under an hour ago (Oct 28, 2026, 11:40 AM ET)

Does this affect you?

It affects Linux and 1 other product. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: net: bcmgenet: fix racing timeout handler The bcmgenet_timeout handler tries to take down all tx queues when a single queue times out. This is over zealous and causes many race conditions with queues that are still chugging along. Instead lets only restart the timed out queue.

CVSS: 9.8 CRITICAL (v3.1, CNA)CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness (CWE): CWE-362
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Modified
Record last updated: Oct 19, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from 13ea657806cf73b379a0109f7042182f47c351a7 before e85b0c0a12e967930044608311471b665baa315c; from 13ea657806cf73b379a0109f7042182f47c351a7 before e8206538cbaf4f4068e99a4cb1138690a1e00499; from 13ea657806cf73b379a0109f7042182f47c351a7 before 681fdfe823b4f1036ed50b58b8838c7917ea389c; from 13ea657806cf73b379a0109f7042182f47c351a7 before c270e2bec3e55a716d25c35341091339457ac883; 13ea657806cf73b379a0109f7042182f47c351a7 builds before 7ce1c26aac3b318886a57425f64b522da7389153; from 13ea657806cf73b379a0109f7042182f47c351a7 before 5393b2b5bee2ac51a0043dc7f4ac3475f053d08d	CNA record
linux linux_kernel linux:linux_kernel	from 4.2 before 6.1.175; from 6.2 before 6.6.141; from 6.7 before 6.12.91; from 6.13 before 6.18.33; from 6.19 before 7.0.10	NVD

References

References

https://git.kernel.org/stable/c/e85b0c0a12e967930044608311471b665baa315c	patch
https://git.kernel.org/stable/c/e8206538cbaf4f4068e99a4cb1138690a1e00499	patch
https://git.kernel.org/stable/c/681fdfe823b4f1036ed50b58b8838c7917ea389c	patch
https://git.kernel.org/stable/c/c270e2bec3e55a716d25c35341091339457ac883	patch
https://git.kernel.org/stable/c/7ce1c26aac3b318886a57425f64b522da7389153	patch
https://git.kernel.org/stable/c/5393b2b5bee2ac51a0043dc7f4ac3475f053d08d	patch

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.