CVE-2026-53086: net: bcmgenet: fix racing timeout handler

Synopsis

A race condition vulnerability exists in the Linux kernel's bcmgenet network driver, reachable over the network without any authentication. The flaw is triggered when a transmit queue timeout fires and the handler incorrectly shuts down all TX queues rather than only the timed-out one, creating race conditions with active queues. Successful exploitation gives an attacker full read, write, and availability impact on the affected system. Patched-image rebuilds at the fix versions (6.1.175, 6.6.141, and 6.12.91) are available on HarborGuard for environments running affected kernel versions.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable code path is exposed over the network, meaning an attacker must be able to reach the affected host's network interface to trigger the race condition.

• AuthenticationNot required

  No credentials or account privileges are needed; the vulnerability can be triggered by an unauthenticated network peer.

• Victim interactionNot required

  No user or administrator action is required to complete exploitation; the attacker does not need to social-engineer anyone.

• Attack complexityDetail

  Attack complexity is rated Low, meaning the exploit is reliable and does not depend on race-window timing from the attacker's side, environmental layout, or other preconditions outside the attacker's control.

Blast Radius

• A successful attacker reads kernel memory contents, which may include session tokens, cryptographic keys, or other sensitive data held in the affected system.
• The attacker can write to kernel memory structures, modifying persisted state or injecting malicious data into active network flows.
• The racing timeout handler can crash or hang the bcmgenet network driver, taking down network connectivity for the affected host.
• A kernel crash or corrupted driver state may require a full host reboot, disrupting all services running on that node.