CVE-2026-53088
Full vulnerability record from the local CVENow database.
Description
In the Linux kernel, the following vulnerability has been resolved: net: bcmgenet: fix off-by-one in bcmgenet_put_txcb The write_ptr points to the next open tx_cb. We want to return the tx_cb that gets rewinded, so we must rewind the pointer first then return the tx_cb that it points to. That way the txcb can be correctly cleaned up.
Severity
CRITICAL
CVSS score
9.8
(v3.1)
Vulnerability status
Modified
Source identifier
416baaa9-dc9f-4396-8d5f-8c081fb06d67
Published
2026-06-24 17:17:22.980000
Last modified
2026-10-19 20:19:02.477000
View original CVE JSON
{
"id": "CVE-2026-53088",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"published": "2026-06-24T17:17:22.980",
"lastModified": "2026-10-19T20:19:02.477",
"vulnStatus": "Modified",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: bcmgenet: fix off-by-one in bcmgenet_put_txcb\n\nThe write_ptr points to the next open tx_cb. We want to return the\ntx_cb that gets rewinded, so we must rewind the pointer first then\nreturn the tx_cb that it points to. That way the txcb can be correctly\ncleaned up."
}
],
"affected": [
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"affectedData": [
{
"vendor": "Linux",
"product": "Linux",
"defaultStatus": "unaffected",
"programFiles": [
"drivers/net/ethernet/broadcom/genet/bcmgenet.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"versions": [
{
"version": "876dbadd53a7102e2a84afc84ea2bd3ee6dc5636",
"lessThan": "14e9f86564fff7bcf7f45c1b69080e837b31d185",
"versionType": "git",
"status": "affected"
},
{
"version": "876dbadd53a7102e2a84afc84ea2bd3ee6dc5636",
"lessThan": "fb9a3c1f547d0ff024dbfe7b6f327626ddf0a3de",
"versionType": "git",
"status": "affected"
},
{
"version": "876dbadd53a7102e2a84afc84ea2bd3ee6dc5636",
"lessThan": "85f34ec320d3881badfd4edc5fee5cd5012bb54d",
"versionType": "git",
"status": "affected"
},
{
"version": "876dbadd53a7102e2a84afc84ea2bd3ee6dc5636",
"lessThan": "2a74590170427a3ca7cc4bb8690cdd559129c29c",
"versionType": "git",
"status": "affected"
},
{
"version": "876dbadd53a7102e2a84afc84ea2bd3ee6dc5636",
"lessThan": "29394f722f620281f2ee9a47f947734e53d72c90",
"versionType": "git",
"status": "affected"
},
{
"version": "876dbadd53a7102e2a84afc84ea2bd3ee6dc5636",
"lessThan": "4cab761fc51c65aef741fcece4a18f3554edbc09",
"versionType": "git",
"status": "affected"
},
{
"version": "876dbadd53a7102e2a84afc84ea2bd3ee6dc5636",
"lessThan": "72df896e31ddd06fcc5a789f025ad7a62a18bc9b",
"versionType": "git",
"status": "affected"
},
{
"version": "876dbadd53a7102e2a84afc84ea2bd3ee6dc5636",
"lessThan": "57f3f53d2c9c5a9e133596e2f7bc1c50688a6d38",
"versionType": "git",
"status": "affected"
},
{
"version": "3bdf77194ea822390b405639b77659071fd2c2e9",
"versionType": "git",
"status": "affected"
},
{
"version": "3.16.50",
"lessThan": "3.17",
"versionType": "semver",
"status": "affected"
}
]
},
{
"vendor": "Linux",
"product": "Linux",
"defaultStatus": "affected",
"programFiles": [
"drivers/net/ethernet/broadcom/genet/bcmgenet.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"versions": [
{
"version": "4.13",
"status": "affected"
},
{
"version": "0",
"lessThan": "4.13",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "5.10.258",
"lessThanOrEqual": "5.10.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "5.15.209",
"lessThanOrEqual": "5.15.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "6.1.175",
"lessThanOrEqual": "6.1.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "6.6.141",
"lessThanOrEqual": "6.6.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "6.12.91",
"lessThanOrEqual": "6.12.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "6.18.33",
"lessThanOrEqual": "6.18.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "7.0.10",
"lessThanOrEqual": "7.0.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "7.1",
"lessThanOrEqual": "*",
"versionType": "original_commit_for_fix",
"status": "unaffected"
}
]
}
]
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"availabilityImpact": "HIGH"
},
"exploitabilityScore": 3.9,
"impactScore": 5.9
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"timestamp": "2026-10-16T15:25:29.702977Z",
"id": "CVE-2026-53088",
"options": [
{
"exploitation": "none"
},
{
"automatable": "yes"
},
{
"technicalImpact": "total"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Primary",
"description": [
{
"lang": "en",
"value": "CWE-193"
}
]
},
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-193"
}
]
}
],
"configurations": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "3.16.50",
"versionEndExcluding": "3.17",
"matchCriteriaId": "04CF39E5-B417-4D51-8790-B5A3C24CF085"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.13.1",
"versionEndExcluding": "5.10.258",
"matchCriteriaId": "782ACCA7-65B5-4785-BD52-4601EF2793E5"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.11",
"versionEndExcluding": "5.15.209",
"matchCriteriaId": "919C10A9-7951-4A74-BADD-C135A0A8D8B4"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.16",
"versionEndExcluding": "6.1.175",
"matchCriteriaId": "92385813-D91D-480D-83A1-F423D2CBB2BA"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.2",
"versionEndExcluding": "6.6.141",
"matchCriteriaId": "97A9FFFA-22BB-4D5C-9790-5A2286E392F7"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.7",
"versionEndExcluding": "6.12.91",
"matchCriteriaId": "C918746B-DE6F-448F-A93E-A04C5481688D"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.13",
"versionEndExcluding": "6.18.33",
"matchCriteriaId": "96D99E49-380D-43AB-BDBA-25C3AD018A9C"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.19",
"versionEndExcluding": "7.0.10",
"matchCriteriaId": "A13475D2-59BF-4716-94B5-7C1D239A2CF4"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:4.13:-:*:*:*:*:*:*",
"matchCriteriaId": "40253A59-8422-42B7-B45F-FF9C4A824F3E"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:4.13:rc2:*:*:*:*:*:*",
"matchCriteriaId": "CCBE5190-4EFC-4C4E-BE91-5711E04F3D26"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:4.13:rc3:*:*:*:*:*:*",
"matchCriteriaId": "CB7715C0-AB55-458B-9242-8BEE9446F6D4"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:4.13:rc4:*:*:*:*:*:*",
"matchCriteriaId": "BA601A37-DCB0-45D4-AE9A-637221D488DA"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:4.13:rc5:*:*:*:*:*:*",
"matchCriteriaId": "44295B9F-B686-4BD8-8C59-26CB590557B9"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:4.13:rc6:*:*:*:*:*:*",
"matchCriteriaId": "BBAEC1E0-FD67-4750-9816-975321F3EF01"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:4.13:rc7:*:*:*:*:*:*",
"matchCriteriaId": "142B57DF-C83F-45A1-A296-70863DDA1539"
}
]
}
]
}
],
"references": [
{
"url": "https://git.kernel.org/stable/c/14e9f86564fff7bcf7f45c1b69080e837b31d185",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
]
},
{
"url": "https://git.kernel.org/stable/c/29394f722f620281f2ee9a47f947734e53d72c90",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
]
},
{
"url": "https://git.kernel.org/stable/c/2a74590170427a3ca7cc4bb8690cdd559129c29c",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
]
},
{
"url": "https://git.kernel.org/stable/c/4cab761fc51c65aef741fcece4a18f3554edbc09",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
]
},
{
"url": "https://git.kernel.org/stable/c/57f3f53d2c9c5a9e133596e2f7bc1c50688a6d38",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
]
},
{
"url": "https://git.kernel.org/stable/c/72df896e31ddd06fcc5a789f025ad7a62a18bc9b",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
]
},
{
"url": "https://git.kernel.org/stable/c/85f34ec320d3881badfd4edc5fee5cd5012bb54d",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
]
},
{
"url": "https://git.kernel.org/stable/c/fb9a3c1f547d0ff024dbfe7b6f327626ddf0a3de",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
]
}
]
}