CVE-2026-64125
A flaw in the Linux kernel's bcmgenet network driver causes the receive path to stop working when Energy Efficient Ethernet (EEE) and power‑management bits are enabled, halting RX traffic while the link appears up and potentially triggering a paging fault. The issue is resolved by ensuring those bits remain cleared in the driver.
An official fix is available, so this entry is kept for 30 days and then removed automatically.
Who is affected
Linux systems using the bcmgenet driver (e.g., Raspberry Pi 4B with BCM2711 + BCM54213PE or Broadcom 4908-family boards).
Real-world impact
Network receive traffic stops even though the link stays up, which can lead to dropped connections and, on some systems, a paging fault in skb_release_data.
Why this severity
CVSS v3.1 base score 9.8 (Critical) due to network‑adjacent attack complexity, no privileges or user interaction required, and full impact on confidentiality, integrity, and availability.
What to do about it
- 01Upgrade the Linux kernel to a version that includes the patch clearing RBUF_EEE_EN and RBUF_PM_EN in the bcmgenet_eee_enable_set function (or apply the equivalent kernel patch).
NVD-referenced vendor advisory (Linux kernel fix described in NVD description)
Timeline
- Jul 19, 2026 · 14d agoPublishedDisclosed and added to the National Vulnerability Database.
- Jul 20, 2026 · 13d agoOfficial fix availableA vendor patch or mitigation now exists — see the remediation steps above.
- Jul 30, 2026 · 3d agoAdvisory updatedThe NVD record was last revised.
How it’s attacked
References & advisories
- git.kernel.org/stable/c/2040eb83f6ada148fb…
- git.kernel.org/stable/c/289499907399c5a9f2…
- git.kernel.org/stable/c/3d4ef05266ab16d8ef…
- git.kernel.org/stable/c/49bdf6bbb21b9c6e3f…
- git.kernel.org/stable/c/9a1730245e416d11ad…
- git.kernel.org/stable/c/a212fc08f5c48a16a9…
- git.kernel.org/stable/c/b579f3a73da7a7e742…
- git.kernel.org/stable/c/f2782ddac82c70df31…