CVE-2026-53087: Linux bcmgenet Driver Memory Leak Causes Network DoS

Technical summary

CVE-2026-53087 is a resource exhaustion vulnerability in the bcmgenet driver within the Linux kernel. The vulnerability occurs in the transmit queue reclamation logic. When frames are dropped by fast-forwarding the write pointer during queue cleanup, the corresponding buffer descriptors (free_bds) are not returned to the available pool, nor is the netdev layer notified of the dropped packets. This violates the driver's resource accounting and leads to CWE-401 (Missing Release of Memory after Effective Lifetime). Over time, repeated queue reclamation events can exhaust transmable buffer resources, causing denial of service.

Business impact

Organizations running Linux systems with Broadcom GENET network interfaces face potential denial of service on affected machines. Repeated or sustained network queue cleanup events can leak memory buffers, eventually starving legitimate network traffic transmission. This is particularly concerning in data center, embedded, or IoT deployments where Broadcom network hardware is prevalent. Service degradation may manifest as network timeouts, dropped connections, or system unresponsiveness, impacting availability and user experience.

Affected systems

The vulnerability affects Linux kernel versions running the bcmgenet driver. This driver is used in systems with Broadcom GENET network interface controllers, commonly found in ARM-based embedded systems, some server platforms, and network appliances. Affected parties should verify their kernel version and confirm whether bcmgenet is active in their network stack (via lsmod or similar kernel module inspection tools).

Exploitability

This is a memory leak triggered through normal network operations rather than requiring direct attacker interaction. The vulnerability manifests when the driver reclaims the transmit queue—a routine operation that may occur during network resets, error recovery, or driver unload. No special privileges, network access controls, or user interaction are required to trigger the condition. The CVSS 3.1 score of 7.5 (HIGH, AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) reflects the ease of exploitation and the availability impact, though neither confidentiality nor integrity is directly compromised.

Remediation

The kernel developers have resolved this issue by ensuring that when the transmit queue is reclaimed, buffer descriptors are properly returned to the free pool and the netdev layer is notified of dropped packets. Organizations should apply the patched kernel version from their Linux distribution. Verify the patch status through your vendor's advisory and test the update in a staging environment before production deployment.

Patch guidance

Obtain and install the patched Linux kernel from your distribution's repository or the official Linux kernel project. The fix modifies the transmit queue cleanup routine in the bcmgenet driver to correctly account for released buffers. Distributions typically provide kernel updates via their package manager (apt, yum, zypper, etc.). After patching, reboot the affected system to activate the fix. Confirm bcmgenet is loaded with the new kernel version using 'modinfo bcmgenet' or kernel log inspection.

Detection guidance

Monitor kernel logs and system metrics for signs of buffer exhaustion: watch for repeated 'out of memory' errors tied to network driver operations, or persistent warnings from the bcmgenet driver about queue state. Use 'ethtool -S <interface>' to inspect bcmgenet interface statistics for anomalies in dropped packets or transmit errors. Correlate timestamp spikes in tx_dropped counters with network resets or driver state changes. Kernel debugging tools (e.g., 'cat /proc/net/dev' or network monitoring with 'ip' and 'ss' commands) can reveal reduced network performance or stalled connections on affected interfaces.

Why prioritize this

This vulnerability merits prompt patching because it affects availability through a mechanism that does not require special attack sophistication—ordinary network operations can trigger buffer exhaustion. The HIGH CVSS score reflects the straightforward exploitability and direct availability impact. Organizations with Broadcom GENET hardware should prioritize this over lower-severity issues, particularly if they operate critical network services or embedded systems where downtime is costly. The lack of KEV status does not diminish urgency; exploitation may simply not yet be weaponized in public attack campaigns.

Risk score, explained

CVE-2026-53087 receives a CVSS 3.1 score of 7.5 (HIGH) because: (1) Network vector (AV:N) means remote triggering is possible through normal network traffic patterns; (2) Low complexity (AC:L) indicates no special attack prerequisites; (3) No privileges (PR:N) or user interaction (UI:N) required; (4) Availability impact is High (A:H) due to resource exhaustion leading to denial of service. Confidentiality and Integrity are not affected, keeping the score below Critical. The vulnerability is practically exploitable by any actor with network reachability to a system running the vulnerable driver.

Frequently asked questions