The Linux kernel bcmgenet networking driver contained an off‑by‑one error in its transmit control block handling. The write pointer referenced the next available control block, but the driver needed to rewind the pointer before returning the block that would be recycled. Because the pointer was rewound too late, the code returned an unintended control block and failed to clean up the original, which could corrupt kernel memory or lead to a kernel panic. This flaw represents an off‑by‑one pointer error (CWE‑680) that can be exploited through crafted network traffic to cause denial of service or, potentially, privilege escalation.

The vulnerability affects all Linux kernels that include the bcmgenet module, which is used in many embedded and networking devices. The bug was addressed in the mainline kernel commit referenced in the advisory, but the specific version range is not listed in the data; therefore, any system running an unpatched kernel that compiles bcmgenet is at risk.

No CVSS or EPSS score was offered, and the vulnerability has not appeared in CISA’s KEV list. Because the defect involves kernel memory manipulation, the attack requires a vector that can drive tx_cb handling – usually by sending specially crafted frames over the bcmgenet interface. The likely attack surface therefore is network traffic directed at the device; an attacker with such access could trigger the off‑by‑one error and cause a crash or memory corruption. Although no public exploits exist, the severity warrants prompt remediation.