CVE-2026-98052 net: bcmasp: clear txcb->last before writing each descriptor
A use-after-free vulnerability in the Linux kernel's bcmasp network driver allows attackers to cause system crashes or potentially execute code via crafted network traffic.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-98052?
CVE-2026-98052 is a high-severity use after free vulnerability in Linux kernel, published on 25 Sep 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
net: bcmasp: clear txcb->last before writing each descriptor
bcmasp_xmit() only wrote txcb->last = true for the final fragment of an SKB; non-final fragments left the field untouched. If a descriptor slot was reused while it still held a stale true from a previous SKB (possible when tx_spb_ring_full() underreported fullness), bcmasp_tx_reclaim() would see last == true mid-SKB and call dev_consume_skb_any() prematurely, freeing the sk_buff while its remaining fragments were still in flight.
Unconditionally clear txcb->last before the conditional set so every descriptor slot starts from a known false state regardless of what a prior transmission left behind.
Which versions are affected by CVE-2026-98052?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2026-98052?
Apply the vendor's patch.
Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.
Is CVE-2026-98052 being exploited?
There is no known exploitation of CVE-2026-98052 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as AZL-104628, BELL-CVE-2026-98052, DEBIAN-CVE-2026-98052, GHSA-r6jq-c3gp-4896, UBUNTU-CVE-2026-98052.