Cloudanix VulnDB

CVE-2026-98304

None

CVSS

—

EPSS

0.2%

Published

Oct 6, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

Network filtering rules that administrators set on certain Broadcom Ethernet ports disappear after the connection is restarted, so the intended traffic controls stop working without warning.

Exploitation
Local Privilege
Attacker needs
Low Privilege
Complexity
Trivial
Impact
Other
Component
OS kernel
Class
Other
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

User-configured ethtool flow-type rules are silently discarded because bcmgenet_hfb_init() calls INIT_LIST_HEAD() on the rxnfc list on every interface open, and bcmgenet_open() invokes this routine on each ifup without restoring previously added hardware filters.

Why it matters to the business

Systems relying on persistent traffic classification or hardware filtering rules on Broadcom GENET interfaces lose those policies after routine interface state changes, which can silently degrade network segmentation, QoS, or security controls.

How an attack unfolds

An attacker does not actively trigger the flaw; instead, any legitimate interface down/up cycle (reboot, link flap, admin action, or resume) causes the kernel to drop all previously installed ethtool rules, removing intended traffic steering or filtering without notification.

How to fix it

Apply the upstream fix that initializes the rxnfc list only once at probe time and restores rules on open (already present in bcmgenet_resume); update to a kernel containing commit that restores hardware filters on open for bcmgenet.

How to confirm the fix worked

After applying the fix, configure an ethtool flow rule, cycle the interface state, and confirm the rule count remains unchanged with ethtool -n; monitor for absence of rule loss across ifup events.

Typical attack path

  1. Administrator or system event configures ethtool flow rules on a bcmgenet interface
  2. Interface is brought down and back up (ifdown/ifup, reboot, suspend/resume)
  3. bcmgenet_hfb_init() resets the rule list during open
  4. Previously installed hardware filters are gone; traffic is no longer steered or filtered as configured

How to detect it

Correlate ethtool rule configuration commands with subsequent interface state transitions in system logs; look for unexpected drops in active filter counts reported by ethtool -n after link events.

What your security team should do

  • Prioritize patching bcmgenet systems that use ethtool -N flow rules for security or QoS
  • Add interface state change logging and periodic ethtool rule verification to detect rule loss until patched
  • Review whether any security policies depend on hardware filters on affected Broadcom Ethernet devices

The record

In the Linux kernel, the following vulnerability has been resolved: net: bcmgenet: restore the hardware filters on open bcmgenet_hfb_init() runs INIT_LIST_HEAD() on priv->rxnfc_list, which drops every rule off the list, and bcmgenet_open() calls it on each ifup. Every rule the user configured is silently lost: # ethtool -N eth0 flow-type ether dst $MAC action 0 Added rule with ID 0 # ethtool -n eth0 | grep -c Filter: 1 # ip link set eth0 down && ip link set eth0 up # ethtool -n eth0 | grep -c Filter: 0 Initialise the lists once at probe and restore the rules on open, as bcmgenet_resume() already does.

Affected packages

Ecosystem Package Introduced Fixed