{"id":"AZL-111359","summary":"CVE-2026-99192 affecting package kernel 6.6.157.1-1","details":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: bcmgenet: unshare the skb before writing the control block\n\nbcmgenet stores first_cb, last_cb and bytes_sent in the skb control\nblock and reads them back on completion to free the skb and credit BQL.\nether_setup() leaves IFF_TX_SKB_SHARING set, so the stack can resubmit\na shared skb that is still in the ring. The next transmit overwrites\nlast_cb, so the earlier slots complete without crediting their bytes\nand BQL stalls the queue until the watchdog resets it.\n\nUnshare the skb before writing the control block.\n\nReproduce with pktgen in clone_skb mode, which hands the driver the same\nskb while earlier copies are still in the ring:\n\n  modprobe pktgen\n  pg=/proc/net/pktgen\n  echo \"add_device eth0\" \u003e $pg/kpktgend_0\n  echo \"dst_mac AA:BB:CC:DD:EE:FF\" \u003e $pg/eth0\n  echo \"dst 192.0.2.1\" \u003e $pg/eth0\n  echo \"clone_skb 8\" \u003e $pg/eth0\n  echo \"count 0\" \u003e $pg/eth0\n  echo start \u003e $pg/pgctrl &\n  sleep 5\n  echo stop \u003e $pg/pgctrl\n  wait\n  cat /sys/class/net/eth0/queues/tx-0/byte_queue_limits/inflight\n\ninflight stays nonzero on the now idle queue. clone_skb 0 leaves it at\nzero.","modified":"2026-10-29T14:16:29.158209052Z","published":"2026-10-28T11:17:40Z","upstream":["CVE-2026-99192"],"references":[{"type":"WEB","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-99192"}],"affected":[{"package":{"name":"kernel","ecosystem":"Azure Linux:3","purl":"pkg:rpm/azure-linux/kernel"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"6.6.157.1-1"}]}],"database_specific":{"source":"https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-111359.json"}}],"schema_version":"1.9.2"}