Linux aws: In the Linux kernel, the following vulnerability has been resolved: net: bcmgenet: keep RBUF EEE/PM disabled Setting RBUF_EEE_EN | RBUF_PM_EN in… (CVE-2026-64125)

The Linux kernel vulnerability CVE-2026-64125 involves the bcmgenet network driver where setting RBUF_EEE_EN or RBUF_PM_EN bits in RBUF_ENERGY_CTRL breaks the RX path on GENET hardware once MAC EEE becomes active. This causes RX traffic to stop flowing while the link remains up, with no RX errors reported at the network device level. The MAC still accepts frames but does not forward them to DMA, leading to increasing overflow counters and potential paging faults on some boards. The issue was reproduced on Raspberry Pi 4B (BCM2711 + BCM54213PE) and confirmed on Broadcom 4908-family hardware. The vulnerability is linked to undocumented RBUF_PM_EN behavior and is triggered more frequently due to default enabling of EEE by phy_support_eee(). The fix involves keeping RBUF EEE/PM disabled. The vulnerability is part of a broader set of Linux kernel security fixes released in July 2026, with patches available for affected linux-aws kernel versions.

The vulnerability causes the RX network path to stop processing incoming packets while the link remains operational, resulting in denial of service conditions for network traffic on affected hardware. It can also cause kernel crashes due to paging faults on some boards. This impacts system stability and network availability on affected Linux kernel versions running on GENET hardware. There is no indication of remote code execution or privilege escalation from this specific issue. The CVSS score is 9.8, indicating high severity due to complete loss of confidentiality, integrity, and availability in the network subsystem during exploitation.

A patch is available and should be applied to affected Linux kernel versions. The vendor advisory from Ubuntu confirms that updating to the fixed linux-aws kernel versions resolves the issue. After updating, a system reboot is required to apply the fix. Due to ABI changes, third-party kernel modules may need recompilation and reinstallation. No additional mitigations are required beyond applying the official kernel updates.