CVE-2026-98051

In the Linux kernel, the following vulnerability has been resolved:

net: bcmasp: fix tx spb ring full() checking same slot cnt times

The loop initialised next index from intf->tx spb index on every iteration, so incr ring() always produced the same result and only one slot was ever tested. Move the initialisation before the loop so each iteration advances next index and the function correctly checks that cnt consecutive descriptor slots are available before allowing a new transmission.