{"id":"CVE-2026-53088","summary":"net: bcmgenet: fix off-by-one in bcmgenet_put_txcb","details":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: bcmgenet: fix off-by-one in bcmgenet_put_txcb\n\nThe write_ptr points to the next open tx_cb. We want to return the\ntx_cb that gets rewinded, so we must rewind the pointer first then\nreturn the tx_cb that it points to. That way the txcb can be correctly\ncleaned up.","modified":"2026-10-28T02:31:05.728745906Z","published":"2026-06-24T16:30:27.655Z","related":["SUSE-SU-2026:23066-1","SUSE-SU-2026:23068-1","SUSE-SU-2026:23193-1","SUSE-SU-2026:23194-1","SUSE-SU-2026:23221-1","SUSE-SU-2026:23231-1","SUSE-SU-2026:23237-1","SUSE-SU-2026:23241-1","SUSE-SU-2026:23244-1","SUSE-SU-2026:3790-1","SUSE-SU-2026:3810-1","openSUSE-SU-2026:21555-1"],"database_specific":{"cna_assigner":"Linux","osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/53xxx/CVE-2026-53088.json"},"references":[{"type":"WEB","url":"https://git.kernel.org/stable/c/14e9f86564fff7bcf7f45c1b69080e837b31d185"},{"type":"WEB","url":"https://git.kernel.org/stable/c/29394f722f620281f2ee9a47f947734e53d72c90"},{"type":"WEB","url":"https://git.kernel.org/stable/c/2a74590170427a3ca7cc4bb8690cdd559129c29c"},{"type":"WEB","url":"https://git.kernel.org/stable/c/4cab761fc51c65aef741fcece4a18f3554edbc09"},{"type":"WEB","url":"https://git.kernel.org/stable/c/57f3f53d2c9c5a9e133596e2f7bc1c50688a6d38"},{"type":"WEB","url":"https://git.kernel.org/stable/c/72df896e31ddd06fcc5a789f025ad7a62a18bc9b"},{"type":"WEB","url":"https://git.kernel.org/stable/c/85f34ec320d3881badfd4edc5fee5cd5012bb54d"},{"type":"WEB","url":"https://git.kernel.org/stable/c/fb9a3c1f547d0ff024dbfe7b6f327626ddf0a3de"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/53xxx/CVE-2026-53088.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-53088"},{"type":"PACKAGE","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"876dbadd53a7102e2a84afc84ea2bd3ee6dc5636"},{"fixed":"14e9f86564fff7bcf7f45c1b69080e837b31d185"},{"fixed":"fb9a3c1f547d0ff024dbfe7b6f327626ddf0a3de"},{"fixed":"85f34ec320d3881badfd4edc5fee5cd5012bb54d"},{"fixed":"2a74590170427a3ca7cc4bb8690cdd559129c29c"},{"fixed":"29394f722f620281f2ee9a47f947734e53d72c90"},{"fixed":"4cab761fc51c65aef741fcece4a18f3554edbc09"},{"fixed":"72df896e31ddd06fcc5a789f025ad7a62a18bc9b"},{"fixed":"57f3f53d2c9c5a9e133596e2f7bc1c50688a6d38"}]},{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"3.16.50"},{"fixed":"3.17"}]},{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"3bdf77194ea822390b405639b77659071fd2c2e9"}]}],"versions":["v3.16.85","v3.16.84","v3.16.83","v3.16.82","v3.16.81","v3.16.80","v3.16.79","v3.16.78","v3.16.77","v3.16.76","v3.16.75","v3.16.74","v3.16.73","v3.16.72","v3.16.71","v3.16.70","v3.16.69","v3.16.68","v3.16.67","v3.16.66","v3.16.65","v3.16.64","v3.16.63","v3.16.62","v3.16.61","v3.16.60","v3.16.59","v3.16.58","v3.16.57","v3.16.56","v3.16.55","v3.16.54","v3.16.53","v3.16.52","v3.16.51","v3.16.50"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-53088.json"}},{"package":{"name":"Kernel","ecosystem":"Linux"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.13.0"},{"fixed":"5.10.258"}]},{"type":"ECOSYSTEM","events":[{"introduced":"5.11.0"},{"fixed":"5.15.209"}]},{"type":"ECOSYSTEM","events":[{"introduced":"5.16.0"},{"fixed":"6.1.175"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.2.0"},{"fixed":"6.6.141"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.7.0"},{"fixed":"6.12.91"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.13.0"},{"fixed":"6.18.33"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.19.0"},{"fixed":"7.0.10"}]}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-53088.json"}}],"schema_version":"1.9.2","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}]}