CVE Intelligence
Analysis AI-assisted

CVE-2026-53086: Linux kernel bcmgenet driver race condition in TX timeout handler

CVE-2026-53086 is a race condition (CWE-362) in the bcmgenet network driver of the Linux kernel. The timeout handler stopped all transmit queues when only one queue timed out, which could interfere with queues still working, and the fix restarts only the affected queue. The CNA assigned a CVSS 3.1 base score of 9.8 (critical), and the record shows no CISA KEV listing.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

CVE-2026-53086 affects the bcmgenet network driver in the Linux kernel. According to the record, the timeout handler took down all transmit queues when a single queue timed out, creating race conditions with queues that were still operating. The upstream fix limits the recovery to the timed-out queue.

Impact

  • The record classifies the weakness as CWE-362 (race condition).
  • The CNA scored the issue 9.8 (critical) under CVSS 3.1, with a vector indicating network reachability, no privileges required, no user interaction, and high impact to confidentiality, integrity and availability. The record does not describe concrete consequences, so this should be read as the CNA's scoring rather than a verified outcome.

Affected products and versions

  • Product listed: Linux Linux Kernel.
  • Ranges in the record: from 4.2 before 6.1.175; from 6.2 before 6.6.141; from 6.7 before 6.12.91; from 6.13 before 6.18.33; from 6.19 before 7.0.10.
  • The record lists stable kernel commits as fixes. Check your distribution's kernel package notes for backport status.

Exploitation status

The record shows the vulnerability is not listed in CISA KEV. No confirmed exploitation appears in the sources consulted. No EPSS data is available in the record.

Remediation and mitigation

  • Identify systems running kernels in the affected ranges, including those using bcmgenet-based hardware.
  • Apply the stable kernel update from your vendor or an upstream stable branch that includes the commits listed in the references.
  • Prioritize devices exposed to untrusted networks until they are patched, consistent with the CNA's scoring.

Detection guidance

  • Review kernel logs for repeated transmit timeout messages from the bcmgenet interface, which may indicate the condition is occurring.
  • Maintain a kernel version inventory to confirm which systems run patched builds.

Limitations of the available information

  • The record does not describe a trigger scenario, exploitation conditions or observed impact.
  • No vendor-specific advisory or distribution backport data is included.
  • EPSS and SSVC data are absent.

Frequently asked questions

Is CVE-2026-53086 being actively exploited?

The record does not list it in CISA KEV, and no confirmed exploitation appears in the sources consulted.

What does the fix change?

It stops the driver from taking down all transmit queues when one times out and restarts only the affected queue.

Which kernel versions are affected?

The record lists several ranges starting at 4.2 and ending before the fixed versions 6.1.175, 6.6.141, 6.12.91, 6.18.33 and 7.0.10 on their respective branches.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.