CVE-2026-64125
net: bcmgenet: keep RBUF EEE/PM disabled
Description
In the Linux kernel, the following vulnerability has been resolved: net: bcmgenet: keep RBUF EEE/PM disabled Setting RBUF_EEE_EN | RBUF_PM_EN in RBUF_ENERGY_CTRL breaks the RX path on GENET hardware once MAC EEE becomes active. RX traffic stops flowing while the link stays up and the usual descriptor/RX error counters remain quiet. In that state the MAC still accepts frames (rbuf_ovflow_cnt keeps climbing) but RBUF no longer forwards them to DMA, so rx_packets is no longer incremented at the netdev level. On some boards the corruption ends up as a paging fault in skb_release_data via bcmgenet_rx_poll on an LPI exit. Reproduced on Pi 4B (BCM2711 + BCM54213PE) and confirmed by Florian Fainelli on an internal Broadcom 4908-family board with the same crash signature. RBUF_PM_EN is not publicly documented. This shows up more often now that phy_support_eee() enables EEE by default, but it also affects older kernels as soon as TX LPI is turned on via ethtool, so it is not specific to recent changes. Always clear RBUF_EEE_EN | RBUF_PM_EN in bcmgenet_eee_enable_set so the bits stay off across resets. UMAC and TBUF setup is left alone so TX-side EEE keeps working.
INFO
Published Date :
July 19, 2026, 4:17 p.m.
Last Modified :
July 19, 2026, 4:17 p.m.
Remotely Exploit :
No
Source :
416baaa9-dc9f-4396-8d5f-8c081fb06d67
Affected Products
The following products are affected by CVE-2026-64125
vulnerability.
Even if cvefeed.io is aware of the exact versions of the
products
that
are
affected, the information is not represented in the table below.
No affected product recoded yet
Solution
- Ensure RBUF_EEE_EN and RBUF_PM_EN bits are cleared.
- Apply patches that disable RBUF EEE/PM across resets.
- Avoid enabling EEE or LPI via ethtool if vulnerable.
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2026-64125.
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2026-64125 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2026-64125
weaknesses.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-64125 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2026-64125 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
New CVE Received by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Jul. 19, 2026
Action Type Old Value New Value Added Affected [{'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '6ef398ea60d931b97d69ed080bd0bd00fac38ec6', 'lessThan': '2040eb83f6ada148fb32dd98b943a498005d79f2', 'versionType': 'git'}, {'status': 'affected', 'version': '6ef398ea60d931b97d69ed080bd0bd00fac38ec6', 'lessThan': 'f2782ddac82c70df313012da5f71f1f06b5553ca', 'versionType': 'git'}, {'status': 'affected', 'version': '6ef398ea60d931b97d69ed080bd0bd00fac38ec6', 'lessThan': 'b579f3a73da7a7e74213558f4cc3d865c30aaa78', 'versionType': 'git'}, {'status': 'affected', 'version': '6ef398ea60d931b97d69ed080bd0bd00fac38ec6', 'lessThan': '289499907399c5a9f2ed82cb34df49112bb8488f', 'versionType': 'git'}, {'status': 'affected', 'version': '6ef398ea60d931b97d69ed080bd0bd00fac38ec6', 'lessThan': 'a212fc08f5c48a16a94092bf0a9a8b7cf4483b11', 'versionType': 'git'}, {'status': 'affected', 'version': '6ef398ea60d931b97d69ed080bd0bd00fac38ec6', 'lessThan': '3d4ef05266ab16d8ef7dd21658a557801eb78704', 'versionType': 'git'}, {'status': 'affected', 'version': '6ef398ea60d931b97d69ed080bd0bd00fac38ec6', 'lessThan': '49bdf6bbb21b9c6e3f4d0c1910bf0ef98424be95', 'versionType': 'git'}, {'status': 'affected', 'version': '6ef398ea60d931b97d69ed080bd0bd00fac38ec6', 'lessThan': '9a1730245e416d11ad5c0f2c100061d61cc43f60', 'versionType': 'git'}], 'programFiles': ['drivers/net/ethernet/broadcom/genet/bcmgenet.c'], 'defaultStatus': 'unaffected'}, {'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '3.19'}, {'status': 'unaffected', 'version': '0', 'lessThan': '3.19', 'versionType': 'semver'}, {'status': 'unaffected', 'version': '5.10.258', 'versionType': 'semver', 'lessThanOrEqual': '5.10.*'}, {'status': 'unaffected', 'version': '5.15.209', 'versionType': 'semver', 'lessThanOrEqual': '5.15.*'}, {'status': 'unaffected', 'version': '6.1.175', 'versionType': 'semver', 'lessThanOrEqual': '6.1.*'}, {'status': 'unaffected', 'version': '6.6.142', 'versionType': 'semver', 'lessThanOrEqual': '6.6.*'}, {'status': 'unaffected', 'version': '6.12.92', 'versionType': 'semver', 'lessThanOrEqual': '6.12.*'}, {'status': 'unaffected', 'version': '6.18.34', 'versionType': 'semver', 'lessThanOrEqual': '6.18.*'}, {'status': 'unaffected', 'version': '7.0.11', 'versionType': 'semver', 'lessThanOrEqual': '7.0.*'}, {'status': 'unaffected', 'version': '7.1', 'versionType': 'original_commit_for_fix', 'lessThanOrEqual': '*'}], 'programFiles': ['drivers/net/ethernet/broadcom/genet/bcmgenet.c'], 'defaultStatus': 'affected'}] Added Description In the Linux kernel, the following vulnerability has been resolved: net: bcmgenet: keep RBUF EEE/PM disabled Setting RBUF_EEE_EN | RBUF_PM_EN in RBUF_ENERGY_CTRL breaks the RX path on GENET hardware once MAC EEE becomes active. RX traffic stops flowing while the link stays up and the usual descriptor/RX error counters remain quiet. In that state the MAC still accepts frames (rbuf_ovflow_cnt keeps climbing) but RBUF no longer forwards them to DMA, so rx_packets is no longer incremented at the netdev level. On some boards the corruption ends up as a paging fault in skb_release_data via bcmgenet_rx_poll on an LPI exit. Reproduced on Pi 4B (BCM2711 + BCM54213PE) and confirmed by Florian Fainelli on an internal Broadcom 4908-family board with the same crash signature. RBUF_PM_EN is not publicly documented. This shows up more often now that phy_support_eee() enables EEE by default, but it also affects older kernels as soon as TX LPI is turned on via ethtool, so it is not specific to recent changes. Always clear RBUF_EEE_EN | RBUF_PM_EN in bcmgenet_eee_enable_set so the bits stay off across resets. UMAC and TBUF setup is left alone so TX-side EEE keeps working. Added Reference https://git.kernel.org/stable/c/2040eb83f6ada148fb32dd98b943a498005d79f2 Added Reference https://git.kernel.org/stable/c/289499907399c5a9f2ed82cb34df49112bb8488f Added Reference https://git.kernel.org/stable/c/3d4ef05266ab16d8ef7dd21658a557801eb78704 Added Reference https://git.kernel.org/stable/c/49bdf6bbb21b9c6e3f4d0c1910bf0ef98424be95 Added Reference https://git.kernel.org/stable/c/9a1730245e416d11ad5c0f2c100061d61cc43f60 Added Reference https://git.kernel.org/stable/c/a212fc08f5c48a16a94092bf0a9a8b7cf4483b11 Added Reference https://git.kernel.org/stable/c/b579f3a73da7a7e74213558f4cc3d865c30aaa78 Added Reference https://git.kernel.org/stable/c/f2782ddac82c70df313012da5f71f1f06b5553ca