{
  "affected": [
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:12",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:13",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.113-1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:14",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "7.2.10-1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "details": "In the Linux kernel, the following vulnerability has been resolved:  net: bcmgenet: fix NULL dereference in set_coalesce before first open  The Rx ring priv and index are only set in bcmgenet_init_rx_ring(), which runs at open. Setting the Rx coalescing parameters on an interface that was never opened, e.g. \"ethtool -C eth0 rx-usecs 50\", dereferences a NULL ring-\u003epriv. The oops happens with RTNL held, so networking stays stuck until a reboot:    Unable to handle kernel paging request at virtual address 0000000000002788   pc : bcmgenet_set_rx_coalesce.isra.0+0x10/0x88   lr : bcmgenet_set_coalesce+0xe8/0x180   Call trace:    bcmgenet_set_rx_coalesce.isra.0+0x10/0x88 (P)    __ethnl_set_coalesce.isra.0+0x490/0x570    ethnl_set_coalesce+0x48/0xc0    ethnl_default_set_doit+0xf4/0x230    genl_family_rcv_msg_doit+0xe8/0x160    genl_rcv_msg+0x220/0x2a0    netlink_rcv_skb+0x68/0x140    genl_rcv+0x40/0x60    netlink_unicast+0x338/0x3c0    netlink_sendmsg+0x19c/0x3f8    __sock_sendmsg+0x64/0xc0    __sys_sendto+0x124/0x198    __arm64_sys_sendto+0x30/0x48  Set priv and index at probe. Writing the registers while the interface is down is harmless because open resets the MAC and bcmgenet_init_rx_coalesce() reapplies the stored values.  It was observed on a Raspberry Pi CM4, but should apply to all other genet devices.",
  "id": "DEBIAN-CVE-2026-98798",
  "modified": "2026-10-19T04:47:31.838861835Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://security-tracker.debian.org/tracker/CVE-2026-98798"
    }
  ],
  "upstream": [
    "CVE-2026-98798"
  ]
}