CVE-2026-98574

In the Linux kernel, the following vulnerability has been resolved:

net: bcmgenet: stop Tx NAPI before disabling the queues

bcmgenet netif stop() and the Wake-on-LAN branch of bcmgenet suspend() both disable the Tx queues first and stop Tx NAPI several steps later. A completion in flight calls netif tx wake queue() in between, and nothing stops the queue again, so a transmit can reach the rings after they have been freed.

Close is safe because dev deactivate many() stops the qdisc first. bcmgenet suspend() does not, so stop Tx NAPI before the queues on both paths.

KASAN on a Raspberry Pi CM4, driven from an MTU change because suspend freezes user space before the callback runs:

BUG: KASAN: use-after-free in bcmgenet xmit+0x17f8/0x2258 Write of size 8 at addr ffffff8055844a68 by task ksoftirqd/0/14 bcmgenet xmit+0x17f8/0x2258 dev hard start xmit+0x13c/0x588 sch direct xmit+0x108/0x340 dev queue xmit+0x1190/0x3848