CVE-2026-98052

Description

In the Linux kernel, the following vulnerability has been resolved: net: bcmasp: clear txcb->last before writing each descriptor bcmasp_xmit() only wrote txcb->last = true for the final fragment of an SKB; non-final fragments left the field untouched. If a descriptor slot was reused while it still held a stale true from a previous SKB (possible when tx_spb_ring_full() underreported fullness), bcmasp_tx_reclaim() would see last == true mid-SKB and call dev_consume_skb_any() prematurely, freeing the sk_buff while its remaining fragments were still in flight. Unconditionally clear txcb->last before the conditional set so every descriptor slot starts from a known false state regardless of what a prior transmission left behind.

Overview

State: PUBLISHED
Assigner (CNA): Linux
CVSS severity: HIGH
CVSS score: 7.8 / 10
CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Effective score: 7.8 / 10 HIGH source: CNA overview
CWE(s): —
Reserved: 2026-09-25
Published: 2026-09-25 10:24 UTC
Last updated: 2026-09-25 14:41 UTC
Source: https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/98xxx/CVE-2026-98052.json
Linked Threat: CVE-2026-98052 — net: bcmasp: clear txcb->last before writing each descriptor

NVD triage scoring NVD CVE 2.0

Layer NVD adds on top of the CNA's CVE record — published / last-modified timestamps, exploitability / impact subscores, and the FIRST.org EPSS probability that this CVE will be exploited in the wild in the next 30 days.

NVD published: 2026-09-25 11:17:34 UTC
NVD last modified: 2026-09-25 15:18:05 UTC
NVD CVSS v3.1: 7.8 / 10 HIGH source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
NVD CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Exploitability subscore: 1.8 / 10
Impact subscore: 5.9 / 10

European Union Vulnerability Database ENISA EUVD

ENISA's official EU repository for curated vulnerability intelligence. Carries a separate identifier (EUVD-YYYY-NNNN) and frequently exposes an earlier-published description + CVSS than NVD does.

EUVD ID: EUVD-2026-86705
Assigner: Linux
Published: Sep 25, 2026, 10:24:00 AM
Updated: Sep 25, 2026, 2:41:58 PM
EUVD base score (CVSS 3.1): 7.8 / 10
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EUVD-reported EPSS: 0.1300
Vendors: Linux
Products: Linux (patch: 7.3-rc3)

Linux (490cb412007de593e07c1d3e2b1ec4233886707c <18e5e0ec0e9282c897e2aa81a3e43ccaee03b003)

Linux (6.6)

Linux (patch: 7.2.7)

Linux (490cb412007de593e07c1d3e2b1ec4233886707c <47a5cecca925ceb175d5adf712e667acf78f475f)

Linux (patch: 6.12.111)

Linux (490cb412007de593e07c1d3e2b1ec4233886707c <17e6ad484dea5ddf1c4a3d6ec77a5929161234de)

Linux (490cb412007de593e07c1d3e2b1ec4233886707c <9b26b54861ce05307d39a54ddedddf8747419614)

Linux (patch: 6.18.53)

Linux (patch: 0)
Aliases: GHSA-r6jq-c3gp-4896

ENISA description: In the Linux kernel, the following vulnerability has been resolved: net: bcmasp: clear txcb->last before writing each descriptor bcmasp_xmit() only wrote txcb->last = true for the final fragment of an SKB; non-final fragments left the field untouched. If a descriptor slot was reused while it still held a stale true from a previous SKB (possible when tx_spb_ring_full() underreported fullness), bcmasp_tx_reclaim() would see last == true mid-SKB and call dev_consume_skb_any() prematurely, freeing the sk_buff while its remaining fragments were still in flight. Unconditionally clear txcb->last before the conditional set so every descriptor slot starts from a known false state regardless of what a prior transmission left behind.

EUVD references (4)

Affected products (2)

Vendor	Product	Versions	Platforms
Linux	Linux	`490cb412007de593e07c1d3e2b1ec4233886707c` (affected), `490cb412007de593e07c1d3e2b1ec4233886707c` (affected), `490cb412007de593e07c1d3e2b1ec4233886707c` (affected), `490cb412007de593e07c1d3e2b1ec4233886707c` (affected)	—
Linux	Linux	`6.6` (affected), `0` (unaffected), `6.12.111` (unaffected), `6.18.53` (unaffected), `7.2.7` (unaffected), `7.3-rc3` (unaffected)	—

Vendor references (4)

References embedded in the original CVE record by the assigning CNA.

Web references (0)

DuckDuckGo results ranked by threat-intel / vendor advisory domains. Generated by the 🔎 Find references (web) button above — same flow as the Remediations search.

No web references attached yet.

NVD-tagged references (4)

Reference list NVD curates from the CNA record, vendor advisories, and third-party reports. The tag chips below are NVD's analyst-assigned categories.

https://git.kernel.org/stable/c/17e6ad484dea5ddf1c4a3d6ec77a5929161234de 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/18e5e0ec0e9282c897e2aa81a3e43ccaee03b003 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/47a5cecca925ceb175d5adf712e667acf78f475f 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/9b26b54861ce05307d39a54ddedddf8747419614 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Remediations (10)

Remediations are stored against the linked Threat row; the list below is deduplicated across both pages.

CVE-2026-98052 Linux — Exploit & Vulnerability Details HIGH | AnonHaven

web:anonhaven.com

CVE Details CVE ID CVE-2026-98052 Published Date Sep 25, 2026 Vendor Linux Severity HIGH CVSS v3.1 Score 7.8

2026-09-27 22:55 UTC
Citrix NetScaler 0-Day RCE Vulnerabilities Actively Exploited in ...

web:cybersecuritynews.com

Citrix NetScaler administrators are confronting reports of two undisclosed remote code execution vulnerabilities allegedly exploited in real-world attacks.

2026-09-27 22:55 UTC
Identify and remediate vulnerabilities for CVE-2026-8452

web:docs.netscaler.com

Remediate CVE - 2026 -8452 For CVE - 2026 -8452 impacted NetScaler instances, the remediation is a single-step process and you need to upgrade the vulnerable NetScaler instances to a release and build that has the fix . In the GUI, under CVE Detection > Impacted Instances, select the instances and click Proceed to upgrade workflow.

2026-09-27 22:55 UTC
CVE-2026-98052: Product identification pending

web:itknowledgebases.com

CVE-2026-98052 (Product identification pending): High-severity vulnerability requiring prioritized review.

2026-09-27 22:55 UTC
Security Update Guide - Microsoft

web:msrc.microsoft.com

The Microsoft Security Response Center (MSRC) investigates all reports of security vulnerabilities affecting Microsoft products and services, and provides the information here as part of the ongoing effort to help you manage security risks and help keep your systems protected.

2026-09-27 22:55 UTC
Security Update Guide - Microsoft Security Response Center

web:msrc.microsoft.com

Security Update Guide - Microsoft Security Response Center

2026-09-27 22:55 UTC
NVD - Search

web:nvd.nist.gov

Search Please make use of the interactive search interfaces to find information in the database!

2026-09-27 22:55 UTC
Microsoft Patch Tracker (September 2026): Exploit-Ranked | Senserva

web:senserva.com

Every Microsoft security patch (KB) and the CVEs it fixes, with severity, CVSS, and CISA KEV status. Cross-linked to the CVE reference.

2026-09-27 22:55 UTC
September 8, 2026-KB5126052 Cumulative Update for .NET Framework 3.5 ...

web:support.microsoft.com

The September 8, 2026 update for Windows 11, version 24H2, Windows 11, version 25H2 and Microsoft server operating system 24H2 includes security and cumulative reliability improvements in .NET Framework 3.5 and 4.8.1. We recommend that you apply this update as part of your regular maintenance routines. Before you install this update, see the Prerequisites and Restart requirement sections ...

2026-09-27 22:55 UTC
CVE-2026-98052 - vulnerability database | Vulners.com

web:vulners.com

CVE-2026-98052 🗓️ 25 Sep 2026 03:24:00 Reported by Linux Type cve 🔗 web.nvd.nist.gov 👁 11 Views

2026-09-27 22:55 UTC

AI Forensic Analysis

Only Available for Registered Users. Sign in to view.

Raw JSON

The full cvelistV5 record. Download as CVE-2026-98052.json.

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/broadcom/asp2/bcmasp_intf.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "9b26b54861ce05307d39a54ddedddf8747419614",
              "status": "affected",
              "version": "490cb412007de593e07c1d3e2b1ec4233886707c",
              "versionType": "git"
            },
            {
              "lessThan": "47a5cecca925ceb175d5adf712e667acf78f475f",
              "status": "affected",
              "version": "490cb412007de593e07c1d3e2b1ec4233886707c",
              "versionType": "git"
            },
            {
              "lessThan": "17e6ad484dea5ddf1c4a3d6ec77a5929161234de",
              "status": "affected",
              "version": "490cb412007de593e07c1d3e2b1ec4233886707c",
              "versionType": "git"
            },
            {
              "lessThan": "18e5e0ec0e9282c897e2aa81a3e43ccaee03b003",
              "status": "affected",
              "version": "490cb412007de593e07c1d3e2b1ec4233886707c",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/broadcom/asp2/bcmasp_intf.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.6"
            },
            {
              "lessThan": "6.6",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.111",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.53",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.7",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc3",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.111",
                  "versionStartIncluding": "6.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.53",
                  "versionStartIncluding": "6.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.7",
                  "versionStartIncluding": "6.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3-rc3",
                  "versionStartIncluding": "6.6",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: bcmasp: clear txcb->last before writing each descriptor\n\nbcmasp_xmit() only wrote txcb->last = true for the final fragment\nof an SKB; non-final fragments left the field untouched.  If a\ndescriptor slot was reused while it still held a stale true from\na previous SKB (possible when tx_spb_ring_full() underreported\nfullness), bcmasp_tx_reclaim() would see last == true mid-SKB and\ncall dev_consume_skb_any() prematurely, freeing the sk_buff while\nits remaining fragments were still in flight.\n\nUnconditionally clear txcb->last before the conditional set so every\ndescriptor slot starts from a known false state regardless of what a\nprior transmission left behind."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The bug is in bcmasp_xmit() TX ring bookkeeping, reached via sendmsg/sendfile -> dev_queue_xmit -> bcmasp_xmit; no malformed input exists and the trigger is TX ring pressure from multi-fragment (NETIF_F_SG) SKBs, which a local user produces by flooding sockets through the bcmasp interface.\nAC:L - The attacker controls the traffic load: flooding multi-frag SKBs makes buggy tx_spb_ring_full() let bcmasp_xmit overwrite unreclaimed slots, so non-final fragments repeatedly land in slots holding a stale txcb->last=true; no hardware state outside the attacker's control is needed.\nPR:L - Sending TCP/UDP traffic that egresses the bcmasp netdev needs only an ordinary unprivileged local account; there is no capability check anywhere on the transmit path.\nUI:N - No victim action is involved; the attacker generates the transmit traffic entirely by themselves.\nS:U - The corruption affects kernel sk_buff/page memory in the same kernel that runs the driver; no VM or IOMMU boundary is crossed.\nC:H - bcmasp_tx_reclaim() frees the skb (dev_consume_skb_any) while its later fragments are still mapped for DMA, so freed and reallocated pages can be transmitted on the wire and the stale skb is accessed again: a use-after-free with disclosure potential.\nI:H - When the real final fragment is reclaimed later, dev_consume_skb_any() is called a second time on the same skb, a double free/UAF of sk_buff and frag pages that could be groomed into slab corruption.\nA:H - Double freeing the sk_buff and touching freed memory in bcmasp_tx_reclaim() from TX NAPI causes slab corruption and kernel oops/panic on the host."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-25T14:41:58.081Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/9b26b54861ce05307d39a54ddedddf8747419614"
        },
        {
          "url": "https://git.kernel.org/stable/c/47a5cecca925ceb175d5adf712e667acf78f475f"
        },
        {
          "url": "https://git.kernel.org/stable/c/17e6ad484dea5ddf1c4a3d6ec77a5929161234de"
        },
        {
          "url": "https://git.kernel.org/stable/c/18e5e0ec0e9282c897e2aa81a3e43ccaee03b003"
        }
      ],
      "title": "net: bcmasp: clear txcb->last before writing each descriptor",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-98052",
    "datePublished": "2026-09-25T10:24:00.441Z",
    "dateReserved": "2026-09-25T10:19:56.072Z",
    "dateUpdated": "2026-09-25T14:41:58.081Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}