Patch Forecast
Yellow warning
Plan into this sprint.

CVE-2026-98051

In the Linux kernel, the following vulnerability has been resolved: net: bcmasp: fix…

Risk score
43/100
CVSS
5.5 v3.1
Exploit chance (30 days)
0.1%
Published
25 Sep 2026

Open in the live forecast Today's forecast

What to know

What it is
In the Linux kernel, the following vulnerability has been resolved: net: bcmasp: fix tx_spb_ring_full() checking same slot cnt times The loop initialised next_index from intf->tx_spb_index on every iteration, so incr_ring() always produced the same result and only one slot was ever tested. Move the initialisation befo…
Affected
Linux kernel
Fix
Apply the vendor's security update; see the linked advisory.
Exploitation
No known exploitation

Story map

Story map: Linux kernelTHE FLAWSTHE FIXCVE-2026-98051In the Linux kernel, thefollowing vulnerability has beenresolved: net: bcmasp: fix…CVSS 5.5 · EPSS 0%CVE-2026-98130Race conditionCVSS 8.1 · EPSS 0%CVE-2026-98115Race conditionCVSS 8.8 · EPSS 0%CVE-2026-98052In the Linux kernel, thefollowing vulnerability has beenresolved: net: bcmasp: clear…CVSS 7.8 · EPSS 0%FixApply the vendor's securityupdate; see the linked advisory.Who is exposedLinux kernelAMBER · PATCH THIS WEEKLinux kernelIn the Linux kernel, thefollowing vulnerability has beenresolved: sctp: fix a TOCTOUrace inSCTP_CMD_TIMER_START TheSCTP_CMD_TIMER_STARThandler checks timer_pending()…Where it standsNo known exploitationCONNECTS TOSame weaknessCWE-670 (CWE-670)5 other warnings in 30 days →Same productEarlier Linux kernel warnings61 in the last 90 days →
Story map: the flaws, the fix, how it unfolded and what it connects to. Boxes link to the record or article.

At a glance

Linux kernel: Amber, patch this week. In the Linux kernel, the following vulnerability has been resolved: sctp: fix a TOCTOU race in SCTP_CMD_TIMER_START The SCTP_CMD_TIMER_START handler checks timer_pending() before calling timer_reduce(). The timer can expire and detach between these operations, causing timer_reduce() to rearm the timer without taking t…

The flaws

  • CVE-2026-98051: In the Linux kernel, the following vulnerability has been resolved: net: bcmasp: fix… (CVSS 5.5 · EPSS 0%)
  • CVE-2026-98130: Race condition (CVSS 8.1 · EPSS 0%)
  • CVE-2026-98115: Race condition (CVSS 8.8 · EPSS 0%)
  • CVE-2026-98052: In the Linux kernel, the following vulnerability has been resolved: net: bcmasp: clear txcb->last… (CVSS 7.8 · EPSS 0%)

The fix

Fix: Apply the vendor's security update; see the linked advisory.

Who is exposed: Linux kernel

Where it stands

  • No known exploitation

Connects to

Why it is Yellow

  • CVSS 5.5 medium
  • On your watchlist: linux kernel

References

Original description

In the Linux kernel, the following vulnerability has been resolved: net: bcmasp: fix tx_spb_ring_full() checking same slot cnt times The loop initialised next_index from intf->tx_spb_index on every iteration, so incr_ring() always produced the same result and only one slot was ever tested. Move the initialisation before the loop so each iteration advances next_index and the function correctly checks that cnt consecutive descriptor slots are available before allowing a new transmission.

Last activity 25 Sep 2026. Patch Forecast updates every hour.