Cloudanix VulnDB

CVE-2026-98798

None

CVSS

—

EPSS

0.2%

Published

Oct 18, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A bug in certain network drivers can crash the whole computer if someone tries to change network settings before the network connection is started.

Exploitation
Local Privilege
Attacker needs
Low Privilege
Complexity
Trivial
Impact
Denial Of Service
Component
OS kernel
Class
Memory Corruption
Remediation
Patch
Effort
Medium
Patch risk
Low

What it actually does

NULL pointer dereference in bcmgenet_set_rx_coalesce when ethtool coalesce parameters are set on a bcmgenet interface before it has been opened, because rx ring priv and index are only initialized at open time.

Why it matters to the business

Unprivileged local users can trigger an immediate kernel panic that holds RTNL, rendering the system and all networking unusable until a reboot; observed on common embedded platforms such as Raspberry Pi CM4.

How an attack unfolds

An attacker with the ability to execute ethtool (or any process that calls ETHTOOL_SET_COALESCE) issues the command against a genet interface that has never been brought up; the call path through ethnl_set_coalesce dereferences a NULL ring->priv, producing a paging fault while RTNL is held.

How to fix it

Apply the upstream fix that initializes ring priv and index at probe time; rebuild and deploy the corrected kernel; after upgrade, bcmgenet_init_rx_coalesce will re-apply any stored values at open.

How to confirm the fix worked

Confirm the patch is present by inspecting bcmgenet_probe and bcmgenet_init_rx_ring; re-test the ethtool -C command on a down interface and verify no NULL dereference occurs.

Typical attack path

  1. Identify a bcmgenet interface that has not yet been opened
  2. Execute ethtool -C <ifname> rx-usecs <value> or equivalent ETHTOOL_SET_COALESCE ioctl
  3. Kernel oops occurs in bcmgenet_set_rx_coalesce
  4. Networking stack remains stuck until reboot

How to detect it

Search kernel logs and dmesg for the exact oops string "Unable to handle kernel paging request at virtual address 0000000000002788" together with the call trace containing bcmgenet_set_rx_coalesce and __ethnl_set_coalesce.

  • bcmgenet_set_rx_coalesce.isra.0+0x10/0x88
  • Unable to handle kernel paging request at virtual address 0000000000002788
  • ethtool -C.*rx-usecs

What your security team should do

  • Prioritize kernel update for any system using bcmgenet (including Raspberry Pi CM4 and other GENET-based devices)
  • Restrict ethtool usage to trusted users until patched
  • Monitor kernel logs for bcmgenet oops signatures

The record

In the Linux kernel, the following vulnerability has been resolved: net: bcmgenet: fix NULL dereference in set_coalesce before first open The Rx ring priv and index are only set in bcmgenet_init_rx_ring(), which runs at open. Setting the Rx coalescing parameters on an interface that was never opened, e.g. "ethtool -C eth0 rx-usecs 50", dereferences a NULL ring->priv. The oops happens with RTNL held, so networking stays stuck until a reboot: Unable to handle kernel paging request at virtual address 0000000000002788 pc : bcmgenet_set_rx_coalesce.isra.0+0x10/0x88 lr : bcmgenet_set_coalesce+0xe8/0x180 Call trace: bcmgenet_set_rx_coalesce.isra.0+0x10/0x88 (P) __ethnl_set_coalesce.isra.0+0x490/0x570 ethnl_set_coalesce+0x48/0xc0 ethnl_default_set_doit+0xf4/0x230 genl_family_rcv_msg_doit+0xe8/0x160 genl_rcv_msg+0x220/0x2a0 netlink_rcv_skb+0x68/0x140 genl_rcv+0x40/0x60 netlink_unicast+0x338/0x3c0 netlink_sendmsg+0x19c/0x3f8 __sock_sendmsg+0x64/0xc0 __sys_sendto+0x124/0x198 __arm64_sys_sendto+0x30/0x48 Set priv and index at probe. Writing the registers while the interface is down is harmless because open resets the MAC and bcmgenet_init_rx_coalesce() reapplies the stored values. It was observed on a Raspberry Pi CM4, but should apply to all other genet devices.

Affected packages

Ecosystem Package Introduced Fixed