CVE-2022-50877 net: broadcom: bcm4908_enet: update TX stats after actual transmission
A race condition in the Broadcom BCM4908 Ethernet driver causes a NULL pointer dereference, leading to a system crash.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2022-50877?
CVE-2022-50877 is a vulnerability in Linux, published on 30 Dec 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
net: broadcom: bcm4908_enet: update TX stats after actual transmission
Queueing packets doesn't guarantee their transmission. Update TX stats after hardware confirms consuming submitted data.
This also fixes a possible race and NULL dereference. bcm4908_enet_start_xmit() could try to access skb after freeing it in the bcm4908_enet_poll_tx().
Which versions are affected by CVE-2022-50877?
How do I fix CVE-2022-50877?
Apply the vendor's patch.
Is CVE-2022-50877 being exploited?
There is no known exploitation of CVE-2022-50877 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2022-50877, GHSA-pqjx-v84v-r7r4, UBUNTU-CVE-2022-50877.