In the Linux kernel, the following vulnerability has been resolved: net: bcmgenet: stop Tx NAPI before disabling the queues bcmgenet_netif_stop()… (CVE-2026-98574)

The vulnerability in the Linux kernel's bcmgenet driver arises from the order of operations in bcmgenet_netif_stop() and the Wake-on-LAN branch of bcmgenet_suspend(). Both disable Tx queues before stopping Tx NAPI, allowing a transmit completion callback to wake the queue and cause a transmit to access memory after it has been freed. This leads to a use-after-free bug detected by KASAN on a Raspberry Pi CM4. The patch changes the sequence to stop Tx NAPI before disabling the queues on both code paths, preventing the race condition.

This vulnerability can cause use-after-free memory corruption in the bcmgenet network driver, potentially leading to kernel crashes or undefined behavior. It affects systems using the bcmgenet driver, such as Raspberry Pi CM4 devices. There is no indication of remote code execution or privilege escalation from the provided data.

A fix has been implemented to stop Tx NAPI before disabling the Tx queues in the bcmgenet driver. Users should apply the official Linux kernel updates that include this patch. Since this is a kernel-level fix, updating to a patched kernel version is the recommended remediation. Patch status is not explicitly stated in the input data, so check the vendor or Linux kernel advisory for the exact fixed versions and update accordingly.