CVE-2026-53088: net: bcmgenet: fix off-by-one in bcmgenet_put_txcb

Synopsis

An off-by-one memory corruption bug exists in the Linux kernel's bcmgenet network driver, specifically in the bcmgenet_put_txcb function that manages transmit control buffers. The flaw is reachable over the network with no authentication required and no user interaction needed, as reflected in its CVSS 9.8 critical score. Successful exploitation gives an attacker full read, write, and availability impact on the affected system, enabling remote code execution or complete service disruption. Patched-image rebuilds at the fix commits are available on HarborGuard for environments running an affected kernel version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the target service over the network; no physical or local access is needed (AV:N).

• AuthenticationNot required

  No credentials or account of any privilege level are required to attempt exploitation (PR:N).

• Victim interactionNot required

  Exploitation is fully attacker-driven and does not require any action from a user or administrator on the target system (UI:N).

• Attack complexityDetail

  The exploit is reliable and condition-free, requiring no race-condition timing or special environmental setup to succeed (AC:L).

Blast Radius

• A successful attacker reads arbitrary kernel memory, exposing secrets, session material, and data from other processes on the host.
• The attacker gains arbitrary write capability in kernel memory, enabling persistent modification of kernel data structures or loaded code.
• The kernel can be crashed or rendered unresponsive, taking down all services and workloads running on the affected node.
• Because the bug lives in a network driver, a network-adjacent attacker triggering the off-by-one can escalate toward full kernel control without any prior foothold on the host.