Critical 9.8Published Jul 19, 2026

CVE-2026-64125net: bcmgenet: keep RBUF EEE/PM disabled

Updated under an hour ago (Oct 27, 2026, 2:00 PM ET)

Does this affect you?

It affects Linux and 1 other product. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: net: bcmgenet: keep RBUF EEE/PM disabled Setting RBUF_EEE_EN | RBUF_PM_EN in RBUF_ENERGY_CTRL breaks the RX path on GENET hardware once MAC EEE becomes active. RX traffic stops flowing while the link stays up and the usual descriptor/RX error counters remain quiet. In that state the MAC still accepts frames (rbuf_ovflow_cnt keeps climbing) but RBUF no longer forwards them to DMA, so rx_packets is no longer incremented at the netdev level. On some boards the corruption ends up as a paging fault in skb_release_data via bcmgenet_rx_poll on an LPI exit. Reproduced on Pi 4B (BCM2711 + BCM54213PE) and confirmed by Florian Fainelli on an internal Broadcom 4908-family board with the same crash signature. RBUF_PM_EN is not publicly documented. This shows up more often now that phy_support_eee() enables EEE by default, but it also affects older kernels as soon as TX LPI is turned on via ethtool, so it is not specific to recent changes. Always clear RBUF_EEE_EN | RBUF_PM_EN in bcmgenet_eee_enable_set so the bits stay off across resets. UMAC and TBUF setup is left alone so TX-side EEE keeps working.

CVSS: 9.8 CRITICAL (v3.1, CNA)CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Analyzed
Record last updated: Oct 19, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from 6ef398ea60d931b97d69ed080bd0bd00fac38ec6 before 2040eb83f6ada148fb32dd98b943a498005d79f2; from 6ef398ea60d931b97d69ed080bd0bd00fac38ec6 before f2782ddac82c70df313012da5f71f1f06b5553ca; from 6ef398ea60d931b97d69ed080bd0bd00fac38ec6 before b579f3a73da7a7e74213558f4cc3d865c30aaa78; from 6ef398ea60d931b97d69ed080bd0bd00fac38ec6 before 289499907399c5a9f2ed82cb34df49112bb8488f; from 6ef398ea60d931b97d69ed080bd0bd00fac38ec6 before a212fc08f5c48a16a94092bf0a9a8b7cf4483b11; 6ef398ea60d931b97d69ed080bd0bd00fac38ec6 builds before 3d4ef05266ab16d8ef7dd21658a557801eb78704; from 6ef398ea60d931b97d69ed080bd0bd00fac38ec6 before 49bdf6bbb21b9c6e3f4d0c1910bf0ef98424be95; from 6ef398ea60d931b97d69ed080bd0bd00fac38ec6 before 9a1730245e416d11ad5c0f2c100061d61cc43f60	CNA record
linux linux_kernel linux:linux_kernel	from 3.19 before 5.10.258; from 5.11 before 5.15.209; from 5.16 before 6.1.175; from 6.2 before 6.6.142; from 6.7 before 6.12.92; from 6.13 before 6.18.34; from 6.19 before 7.0.11; 7.1; and 3 more ranges	NVD

References

References

https://git.kernel.org/stable/c/2040eb83f6ada148fb32dd98b943a498005d79f2	patch
https://git.kernel.org/stable/c/f2782ddac82c70df313012da5f71f1f06b5553ca	patch
https://git.kernel.org/stable/c/b579f3a73da7a7e74213558f4cc3d865c30aaa78	patch
https://git.kernel.org/stable/c/289499907399c5a9f2ed82cb34df49112bb8488f	patch
https://git.kernel.org/stable/c/a212fc08f5c48a16a94092bf0a9a8b7cf4483b11	patch
https://git.kernel.org/stable/c/3d4ef05266ab16d8ef7dd21658a557801eb78704	patch
https://git.kernel.org/stable/c/49bdf6bbb21b9c6e3f4d0c1910bf0ef98424be95	patch
https://git.kernel.org/stable/c/9a1730245e416d11ad5c0f2c100061d61cc43f60	patch

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.