All vulnerabilities
CVE-2026-97573

Linux: bnxt_en: Handle buffer allocation failure in bnxt_rx_ring_reset()

Linux LinuxOperating systems
Open in ThreatlineRecord JSON
CVSS
8.1High
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.60%Chance of exploitation activity in the next 30 days, higher than 47% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in52fc97cbc3ba118aad84e7c001bf02ebe8496f70Also 40b4a7bb6b0b872b45f017dbf211268de098b75c, 1a3670b6a6b5679fe56c5890157b344f091e64f8 and 3 moreCVE List
Published25 Sep 2026Updated 19 Oct 2026CVE List

What fixes it

  • 52fc97cbc3ba118aad84e7c001bf02ebe8496f70LinuxCVE List
  • 40b4a7bb6b0b872b45f017dbf211268de098b75cLinuxCVE List
  • 1a3670b6a6b5679fe56c5890157b344f091e64f8LinuxCVE List
  • 4a17c73c83798c2fa9c7920ad5a98803adce3e01LinuxCVE List
  • 8b2fd5c0aeda935294159206af9d6179282d425aLinuxCVE List
  • 961e2a17c5e3559b3f8654d2daabdd25a42e770aLinuxCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

In the Linux kernel, the following vulnerability has been resolved:

bnxt_en: Handle buffer allocation failure in bnxt_rx_ring_reset()

bnxt_rx_ring_reset() frees the ring buffers and then reallocates them, ignoring the result.

bnxt_alloc_one_rx_ring() can fail in bnxt_alloc_one_tpa_info_data(), which returns -ENOMEM on the first failed allocation and leaves the remaining rxr->rx_tpa[] entries zeroed.

The error isn't propagated up, so the loop in bnxt_rx_ring_reset continues and at the end the code re-enables TPA with partially unallocated rx_tpa array.

This means that when the agg_id from hardware is mapped to a SW index in rxr->rx_tpa[], an uninitialized slot can be chosen which would hand a zero DMA address to the device.

Fix this by falling back to a global reset, which is what the existing code already does when other functions fail, but unlike the other failure cases this particular failure has to return because TPA can't be re-enabled since the allocation failed.

Text from CVE List

Affected versions 18

  • Linuxaffected: 8fbf58e17dce8f250dda9ad6b0a49b3041f0af14 before 52fc97cbc3ba118aad84e7c001bf02ebe8496f70CVE List
  • Linuxaffected: 8fbf58e17dce8f250dda9ad6b0a49b3041f0af14 before 40b4a7bb6b0b872b45f017dbf211268de098b75cCVE List
  • Linuxaffected: 8fbf58e17dce8f250dda9ad6b0a49b3041f0af14 before af9a2bdaba0b4ceb0fc5e5122ef3fc6b7e5a366aCVE List
  • Linuxaffected: 8fbf58e17dce8f250dda9ad6b0a49b3041f0af14 before cfec9e7f15a56cb0104bac13d01e5d11e1ba84fbCVE List
  • Linuxaffected: 8fbf58e17dce8f250dda9ad6b0a49b3041f0af14 before 1a3670b6a6b5679fe56c5890157b344f091e64f8CVE List
  • Linuxaffected: 8fbf58e17dce8f250dda9ad6b0a49b3041f0af14 before 4a17c73c83798c2fa9c7920ad5a98803adce3e01CVE List
  • Linuxaffected: 8fbf58e17dce8f250dda9ad6b0a49b3041f0af14 before 8b2fd5c0aeda935294159206af9d6179282d425aCVE List
  • Linuxaffected: 8fbf58e17dce8f250dda9ad6b0a49b3041f0af14 before 961e2a17c5e3559b3f8654d2daabdd25a42e770aCVE List
  • Linuxaffected: 5.10CVE List
  • Linuxunaffected: all versions before 5.10CVE List
  • Linuxunaffected: 5.10.271 through 5.10.*CVE List
  • Linuxunaffected: 5.15.222 through 5.15.*CVE List
  • Linuxunaffected: 6.1.189 through 6.1.*CVE List
  • Linuxunaffected: 6.6.158 through 6.6.*CVE List
  • Linuxunaffected: 6.12.111 through 6.12.*CVE List
  • Linuxunaffected: 6.18.53 through 6.18.*CVE List
  • Linuxunaffected: 7.2.7 through 7.2.*CVE List
  • Linuxunaffected: 7.3CVE List

References 8