CVE-2026-98304 in Linux
Summary
by MITRE • 10/06/2026
In the Linux kernel, the following vulnerability has been resolved:
net: bcmgenet: restore the hardware filters on open
bcmgenet_hfb_init() runs INIT_LIST_HEAD() on priv->rxnfc_list, which drops every rule off the list, and bcmgenet_open() calls it on each ifup. Every rule the user configured is silently lost:
# ethtool -N eth0 flow-type ether dst $MAC action 0 Added rule with ID 0 # ethtool -n eth0 | grep -c Filter: 1 # ip link set eth0 down && ip link set eth0 up # ethtool -n eth0 | grep -c Filter: 0
Initialise the lists once at probe and restore the rules on open, as bcmgenet_resume() already does.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/06/2026
The vulnerability identified in the Linux kernel network driver for Broadcom GENET Ethernet controllers involves a critical flaw in how hardware flow control filters are managed during interface state transitions. Specifically, the function bcmgenet_hfb_init is invoked every time the network interface is brought up via the bcmgenet_open routine. This initialization sequence incorrectly executes an INIT_LIST_HEAD operation on the priv->rxnfc_list structure, which effectively clears all existing entries from the linked list that tracks configured flow classification rules. Consequently, any user-defined packet filtering or steering rules established through standard tools such as ethtool are silently discarded during each interface restart cycle, leading to a loss of network policy enforcement without explicit error reporting to the administrator.
From an operational perspective, this defect results in significant security and reliability implications for systems relying on persistent traffic classification. When administrators configure specific actions based on packet headers using commands like ethtool -N, these configurations are intended to persist across interface down-up cycles unless explicitly removed by the user. The current behavior causes all such rules to vanish after a simple network restart or system reboot if the interface is brought up and then taken down again. This can lead to unexpected traffic routing, bypassed security policies that depend on specific flow matches, and potential service disruptions for applications expecting consistent packet handling based on pre-configured filters. The issue essentially undermines the reliability of software-defined networking features within this driver, forcing users to reapply their configurations manually after every interface reset.
The root cause lies in the improper placement of list initialization logic. While initializing lists is necessary when first allocating memory during device probe, doing so repeatedly upon opening an already active or previously configured device destroys existing state data that should be preserved. The correct approach, as demonstrated by the bcmgenet_resume function which handles power management states correctly, involves preserving these rules across lifecycle events and only re-applying them to hardware rather than resetting the software representation of those rules. By moving the list initialization to the probe phase where new memory structures are created for the first time, and ensuring that open operations merely restore existing configurations into the hardware registers, the driver can maintain state consistency without data loss.
This issue aligns with CWE-665, which describes improper initialization, as well as CWE-378 regarding creation of critical resource in an insecure way if viewed through the lens of configuration persistence integrity. In terms of MITRE ATT&CK mapping, while not a direct exploitation vector for initial access, it relates to Defense Evasion techniques where attackers might exploit misconfigured or reset network filters to bypass intrusion detection systems or firewall rules that rely on persistent flow classification. Mitigation requires patching the driver code to separate hardware register initialization from software list management during interface open operations. Administrators relying on this specific Broadcom GENET hardware should ensure their kernel versions include fixes for net: bcmgenet rule persistence issues, and until patched, must manually reapply all ethtool network flow rules after every network interface restart or system reboot to maintain intended security postures.