---
id: CVE-2026-99192
title: 'net: bcmgenet: unshare the skb before writing the control block'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  net: bcmgenet: unshare the skb before writing the control block

  bcmgenet stores first_cb, last_cb and bytes_sent in the skb control
  block and reads them back on comple…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= f48bed16a756f5bc0244acd581f61968f7d7c2a4 <
    40c04abcbc34e3afe338f41dae851ecbd72852ac
  - >-
    Linux >= f48bed16a756f5bc0244acd581f61968f7d7c2a4 <
    7939ad3b4db9eadf45a64f0524f38337a9494672
  - >-
    Linux >= f48bed16a756f5bc0244acd581f61968f7d7c2a4 <
    89771ce4f8f67dcffae561b2ccac95c0f6e3aa01
  - Linux fb4ca2b4bc6712a6ad635df5b9b41131846589f9
  - Linux >= 3.16.50 < 3.17
  - Linux 4.13
published: '2026-10-28'
updated: '2026-10-28'
sourceUpdated: '2026-10-28T10:35:48.686Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-99192'
references:
  - url: 'https://git.kernel.org/stable/c/40c04abcbc34e3afe338f41dae851ecbd72852ac'
  - url: 'https://git.kernel.org/stable/c/7939ad3b4db9eadf45a64f0524f38337a9494672'
  - url: 'https://git.kernel.org/stable/c/89771ce4f8f67dcffae561b2ccac95c0f6e3aa01'
tags:
  - cve.org
ingestedAt: '2026-10-28T11:09:40.373Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

net: bcmgenet: unshare the skb before writing the control block

bcmgenet stores first_cb, last_cb and bytes_sent in the skb control
block and reads them back on completion to free the skb and credit BQL.
ether_setup() leaves IFF_TX_SKB_SHARING set, so the stack can resubmit
a shared skb that is still in the ring. The next transmit overwrites
last_cb, so the earlier slots complete without crediting their bytes
and BQL stalls the queue until the watchdog resets it.

Unshare the skb before writing the control block.

Reproduce with pktgen in clone_skb mode, which hands the driver the same
skb while earlier copies are still in the ring:

  modprobe pktgen
  pg=/proc/net/pktgen
  echo "add_device eth0" > $pg/kpktgend_0
  echo "dst_mac AA:BB:CC:DD:EE:FF" > $pg/eth0
  echo "dst 192.0.2.1" > $pg/eth0
  echo "clone_skb 8" > $pg/eth0
  echo "count 0" > $pg/eth0
  echo start > $pg/pgctrl &
  sleep 5
  echo stop > $pg/pgctrl
  wait
  cat /sys/class/net/eth0/queues/tx-0/byte_queue_limits/inflight

inflight stays nonzero on the now idle queue. clone_skb 0 leaves it at
zero.

## Affected

- `Linux >= f48bed16a756f5bc0244acd581f61968f7d7c2a4 < 40c04abcbc34e3afe338f41dae851ecbd72852ac`
- `Linux >= f48bed16a756f5bc0244acd581f61968f7d7c2a4 < 7939ad3b4db9eadf45a64f0524f38337a9494672`
- `Linux >= f48bed16a756f5bc0244acd581f61968f7d7c2a4 < 89771ce4f8f67dcffae561b2ccac95c0f6e3aa01`
- `Linux fb4ca2b4bc6712a6ad635df5b9b41131846589f9`
- `Linux >= 3.16.50 < 3.17`
- `Linux 4.13`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.