{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-98051", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-25T10:19:56.072Z", "datePublished": "2026-09-25T10:23:59.791Z", "dateUpdated": "2026-09-25T10:23:59.791Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-09-25T10:23:59.791Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: bcmasp: fix tx_spb_ring_full() checking same slot cnt times\n\nThe loop initialised next_index from intf->tx_spb_index on every\niteration, so incr_ring() always produced the same result and only\none slot was ever tested. Move the initialisation before the loop\nso each iteration advances next_index and the function correctly\nchecks that cnt consecutive descriptor slots are available before\nallowing a new transmission."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/net/ethernet/broadcom/asp2/bcmasp_intf.c"], "versions": [{"version": "490cb412007de593e07c1d3e2b1ec4233886707c", "lessThan": "f7f7a16dd46ace4e221336a184c7806f7de19547", "status": "affected", "versionType": "git"}, {"version": "490cb412007de593e07c1d3e2b1ec4233886707c", "lessThan": "a8bddab54aa68b407f12294acb05bd552fb6a492", "status": "affected", "versionType": "git"}, {"version": "490cb412007de593e07c1d3e2b1ec4233886707c", "lessThan": "5df7ecd302488287665ab9767bacba7ed7e2842f", "status": "affected", "versionType": "git"}, {"version": "490cb412007de593e07c1d3e2b1ec4233886707c", "lessThan": "0c5cf62e72d7a666ee4da757e122dc1600df1ecc", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/net/ethernet/broadcom/asp2/bcmasp_intf.c"], "versions": [{"version": "6.6", "status": "affected"}, {"version": "0", "lessThan": "6.6", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.111", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.53", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.7", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3-rc3", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.6", "versionEndExcluding": "6.12.111"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.6", "versionEndExcluding": "6.18.53"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.6", "versionEndExcluding": "7.2.7"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.6", "versionEndExcluding": "7.3-rc3"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/f7f7a16dd46ace4e221336a184c7806f7de19547"}, {"url": "https://git.kernel.org/stable/c/a8bddab54aa68b407f12294acb05bd552fb6a492"}, {"url": "https://git.kernel.org/stable/c/5df7ecd302488287665ab9767bacba7ed7e2842f"}, {"url": "https://git.kernel.org/stable/c/0c5cf62e72d7a666ee4da757e122dc1600df1ecc"}], "title": "net: bcmasp: fix tx_spb_ring_full() checking same slot cnt times", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/net/ethernet/broadcom/asp2/bcmasp_intf.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "f7f7a16dd46ace4e221336a184c7806f7de19547", "status": "affected", "version": "490cb412007de593e07c1d3e2b1ec4233886707c", "versionType": "git"}, {"lessThan": "a8bddab54aa68b407f12294acb05bd552fb6a492", "status": "affected", "version": "490cb412007de593e07c1d3e2b1ec4233886707c", "versionType": "git"}, {"lessThan": "5df7ecd302488287665ab9767bacba7ed7e2842f", "status": "affected", "version": "490cb412007de593e07c1d3e2b1ec4233886707c", "versionType": "git"}, {"lessThan": "0c5cf62e72d7a666ee4da757e122dc1600df1ecc", "status": "affected", "version": "490cb412007de593e07c1d3e2b1ec4233886707c", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/net/ethernet/broadcom/asp2/bcmasp_intf.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.6"}, {"lessThan": "6.6", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.111", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.53", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.7", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3-rc3", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: bcmasp: fix tx_spb_ring_full() checking same slot cnt times\n\nThe loop initialised next_index from intf->tx_spb_index on every\niteration, so incr_ring() always produced the same result and only\none slot was ever tested. Move the initialisation before the loop\nso each iteration advances next_index and the function correctly\nchecks that cnt consecutive descriptor slots are available before\nallowing a new transmission."}], "id": "CVE-2026-98051", "lastModified": "2026-09-25T11:17:34.010", "metrics": {}, "published": "2026-09-25T11:17:34.010", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/0c5cf62e72d7a666ee4da757e122dc1600df1ecc"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/5df7ecd302488287665ab9767bacba7ed7e2842f"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/a8bddab54aa68b407f12294acb05bd552fb6a492"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/f7f7a16dd46ace4e221336a184c7806f7de19547"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: net: bcmasp: fix tx_spb_ring_full() checking same slot cnt times", "id": "2541311", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2541311"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-120", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nnet: bcmasp: fix tx_spb_ring_full() checking same slot cnt times\nThe loop initialised next_index from intf->tx_spb_index on every\niteration, so incr_ring() always produced the same result and only\none slot was ever tested. Move the initialisation before the loop\nso each iteration advances next_index and the function correctly\nchecks that cnt consecutive descriptor slots are available before\nallowing a new transmission.", "A flaw was found in the Linux kernel's Broadcom ASP 2.0 Ethernet driver. When evaluating whether sufficient transmit buffer space is available for outgoing packets, the driver fails to properly verify all required consecutive descriptor slots. A local user could exploit this flaw by generating network traffic under heavy queue load, causing the driver to transmit data into already occupied slots. This issue can lead to buffer corruption, driver failure, and a denial of service (DoS)."], "name": "CVE-2026-98051", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "package_name": "openshift/ose-rhel-coreos-8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-09-25T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-98051\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-98051\nhttps://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98051.mbox"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[490cb412007de593e07c1d3e2b1ec4233886707c,f7f7a16dd46ace4e221336a184c7806f7de19547)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[490cb412007de593e07c1d3e2b1ec4233886707c,a8bddab54aa68b407f12294acb05bd552fb6a492)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[490cb412007de593e07c1d3e2b1ec4233886707c,5df7ecd302488287665ab9767bacba7ed7e2842f)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[490cb412007de593e07c1d3e2b1ec4233886707c,0c5cf62e72d7a666ee4da757e122dc1600df1ecc)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "6.6"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[0,6.6)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.111,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.53,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.2.7,7.3.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.3-rc3,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-09-25T21:00:05.012571+00:00", "title": "BCMASP Transmit Ring Full Index Bug", "updated": "2026-09-26T02:00:02.253851+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"], "weaknesses": ["CWE-199"]}