CVE-2026-53086
Description
A flaw was found in the Linux kernel's bcmgenet network driver. This vulnerability arises from an overly aggressive timeout handler that attempts to reset all network transmission queues when only one experiences an issue. This behavior can create race conditions, potentially leading to system instability or a denial of service, where network services become unavailable.
Statement
The bcmgenet TX timeout handler could perform global recovery when only one TX queue timed out, including reclaim and wake operations for queues that were still active. This creates race conditions in the network driver TX path and may lead to network disruption, driver malfunction, or kernel availability impact. For the CVSS the PR:N is used in the paranoid vector because an adjacent network attacker may be able to influence traffic conditions without a local account, but reliable triggering is hardware and workload dependent. The issue is not a direct packet parsing bug and no concrete UAF or OOB primitive is visible from the patch. Impact is treated as denial of service rather than confirmed privilege escalation or information disclosure.
Mitigation
Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 5.1 | N/A | 9.8 |
| Attack Vector | Local | N/A | Network |
| Attack Complexity | High | N/A | Low |
| Privileges Required | None | N/A | None |
| User Interaction | None | N/A | None |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | None | N/A | High |
| Integrity Impact | None | N/A | High |
| Availability Impact | High | N/A | High |
Vector
Red Hat: CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
cve.org: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Understanding the Weakness (CWE)
Other
Technical Impact: Varies by Context
When code does not follow the instructions for resource management, it can lead to unexpected behaviors and potentially exploitable states.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
