Vulnary
← back to the feed
Critical· 9.8official fix available

CVE-2026-64125

A flaw in the Linux kernel's bcmgenet network driver causes the receive path to stop working when Energy Efficient Ethernet (EEE) and power‑management bits are enabled, halting RX traffic while the link appears up and potentially triggering a paging fault. The issue is resolved by ensuring those bits remain cleared in the driver.

publishedJul 19, 2026
last modifiedJul 30, 2026
sourcesNVD
severity · cvss
9.8
critical · how bad it is
exploitation · epss
<1%
43th percentile · chance of exploitation in 30 days
(ai-assisted) A model wrote this summary from the official data, so double-check it against the source before you act on it. Read the official advisory →
auto-deletes from the system
counting…on Aug 19, 2026

An official fix is available, so this entry is kept for 30 days and then removed automatically.

01

Who is affected

Linux systems using the bcmgenet driver (e.g., Raspberry Pi 4B with BCM2711 + BCM54213PE or Broadcom 4908-family boards).

02

Real-world impact

Network receive traffic stops even though the link stays up, which can lead to dropped connections and, on some systems, a paging fault in skb_release_data.

03

Why this severity

CVSS v3.1 base score 9.8 (Critical) due to network‑adjacent attack complexity, no privileges or user interaction required, and full impact on confidentiality, integrity, and availability.

04

What to do about it

official fix available
recommended steps
  1. 01Upgrade the Linux kernel to a version that includes the patch clearing RBUF_EEE_EN and RBUF_PM_EN in the bcmgenet_eee_enable_set function (or apply the equivalent kernel patch).

NVD-referenced vendor advisory (Linux kernel fix described in NVD description)

05

Timeline

  1. Jul 19, 2026 · 14d ago
    Published
    Disclosed and added to the National Vulnerability Database.
  2. Jul 20, 2026 · 13d ago
    Official fix available
    A vendor patch or mitigation now exists — see the remediation steps above.
  3. Jul 30, 2026 · 3d ago
    Advisory updated
    The NVD record was last revised.
06

How it’s attacked

Attack vectorNetwork (remote)
Attack complexityLow
Privileges requiredNone
User interactionNone needed
ScopeUnchanged
Confidentiality impactHigh
Integrity impactHigh
Availability impactHigh
07

References & advisories

(ai-assisted) A model wrote this summary from the official data, so double-check it against the source before you act on it. Read the official advisory →