[SRU][Q][PATCH 0/1] CVE-2026-53088

[Cengiz Can]

https://ubuntu.com/security/CVE-2026-53088

[ Impact ]

The bcmgenet driver had an off-by-one error in bcmgenet_put_txcb(). The
write_ptr points to the next open tx_cb, but the function returned the tx_cb
before rewinding the pointer, so the wrong tx_cb was returned. This caused the
transmit control block to be cleaned up incorrectly, which could lead to memory
corruption or other undefined behavior in the network path.

[ Fix ]

questing: clean cherry-pick
focal: clean cherry-pick
bionic: clean cherry-pick

[ Test Plan ]

Boot tested.

[ Where Problems Could Occur ]

A regression in this fix would affect the bcmgenet Ethernet driver's transmit
path, potentially causing incorrect handling of tx control blocks, dropped
packets, or improper cleanup of DMA-mapped fragments on affected Broadcom GENET
hardware.