In the Linux kernel, the following vulnerability has been resolved: net: bcmgenet: fix NULL dereference in set_coalesce before first open The Rx… (CVE-2026-98798)

The Linux kernel's bcmgenet driver had a vulnerability where the Rx ring private data and index were only initialized during the interface open operation. If an administrator attempted to set Rx coalescing parameters (e.g., via 'ethtool -C eth0 rx-usecs 50') before the interface was opened, the driver would dereference a NULL pointer, causing a kernel oops and network hang. The root cause was that bcmgenet_init_rx_ring(), which sets these values, runs only at open. The fix was to set the private data and index at probe time, ensuring safe register writes even when the interface is down. This vulnerability was observed on Raspberry Pi CM4 but is applicable to all bcmgenet devices.

Exploitation of this vulnerability causes a kernel NULL pointer dereference leading to a kernel oops and network stack hang. The system's networking remains stuck until a reboot, resulting in denial of network service. There is no indication of privilege escalation or data corruption beyond the denial of service.

A fix has been implemented in the Linux kernel to initialize the bcmgenet driver's private data and index at probe time, preventing the NULL dereference. Users should update to a kernel version that includes this fix. No additional mitigation is required as the issue is resolved by this official fix.