CVE-2026-98798

In the Linux kernel, the following vulnerability has been resolved:

net: bcmgenet: fix NULL dereference in set coalesce before first open

The Rx ring priv and index are only set in bcmgenet init rx ring(), which runs at open. Setting the Rx coalescing parameters on an interface that was never opened, e.g. "ethtool -C eth0 rx-usecs 50", dereferences a NULL ring->priv. The oops happens with RTNL held, so networking stays stuck until a reboot:

Unable to handle kernel paging request at virtual address 0000000000002788 pc : bcmgenet set rx coalesce.isra.0+0x10/0x88 lr : bcmgenet set coalesce+0xe8/0x180 Call trace: bcmgenet set rx coalesce.isra.0+0x10/0x88 (P) ethnl set coalesce.isra.0+0x490/0x570 ethnl set coalesce+0x48/0xc0 ethnl default set doit+0xf4/0x230 genl family rcv msg doit+0xe8/0x160 genl rcv msg+0x220/0x2a0 netlink rcv skb+0x68/0x140 genl rcv+0x40/0x60 netlink unicast+0x338/0x3c0 netlink sendmsg+0x19c/0x3f8 sock sendmsg+0x64/0xc0 sys sendto+0x124/0x198 arm64 sys sendto+0x30/0x48

Set priv and index at probe. Writing the registers while the interface is down is harmless because open resets the MAC and bcmgenet init rx coalesce() reapplies the stored values.

It was observed on a Raspberry Pi CM4, but should apply to all other genet devices.