CVE-2026-64125

In the Linux kernel, the following vulnerability has been resolved:

net: bcmgenet: keep RBUF EEE/PM disabled

Setting RBUFEEEEN | RBUFPMEN in RBUFENERGYCTRL breaks the RX

path on GENET hardware once MAC EEE becomes active. RX traffic stops

flowing while the link stays up and the usual descriptor/RX error

counters remain quiet. In that state the MAC still accepts frames

(rbufovflowcnt keeps climbing) but RBUF no longer forwards them to

DMA, so rx_packets is no longer incremented at the netdev level. On

some boards the corruption ends up as a paging fault in

skbreleasedata via bcmgenetrxpoll on an LPI exit.

Reproduced on Pi 4B (BCM2711 + BCM54213PE) and confirmed by Florian

Fainelli on an internal Broadcom 4908-family board with the same crash

signature. RBUFPMEN is not publicly documented.

This shows up more often now that physupporteee() enables EEE by

default, but it also affects older kernels as soon as TX LPI is

turned on via ethtool, so it is not specific to recent changes.

Always clear RBUFEEEEN | RBUFPMEN in bcmgeneteeeenable_set so

the bits stay off across resets. UMAC and TBUF setup is left alone so

TX-side EEE keeps working.