Skip to main content
cve.nowby Sazabi
← All vulnerabilities
CVE-2026-97573

bnxt_en: Handle buffer allocation failure in bnxt_rx_ring_reset()

Published
Last modified
published
Not listed in CISA KEV
Fix
Fixed in 5.10.271, 5.15.222, 6.1.189, 6.6.158, 6.12.111, and 2 more
None on Exploit-DB, Metasploit or GitHub

Summary

In the Linux kernel, the following vulnerability has been resolved: bnxt_en: Handle buffer allocation failure in bnxt_rx_ring_reset() bnxt_rx_ring_reset() frees the ring buffers and then reallocates them, ignoring the result. bnxt_alloc_one_rx_ring() can fail in bnxt_alloc_one_tpa_info_data(), which returns -ENOMEM on the first failed allocation and leaves the remaining rxr->rx_tpa[] entries zeroed. The error isn't propagated up, so the loop in bnxt_rx_ring_reset continues and at the end the code re-enables TPA with partially unallocated rx_tpa array. This means that when the agg_id from hardware is mapped to a SW index in rxr->rx_tpa[], an uninitialized slot can be chosen which would hand a zero DMA address to the device. Fix this by falling back to a global reset, which is what the existing code already does when other functions fail, but unlike the other failure cases this particular failure has to return because TPA can't be re-enabled since the allocation failed.

Timeline

  1. CVE published
  2. Record last updated

Affected versions

  • Linux Linux

    From 8fbf58e17dce8f250dda9ad6b0a49b3041f0af14 · fixed in 52fc97cbc3ba118aad84e7c001bf02ebe8496f70; From 8fbf58e17dce8f250dda9ad6b0a49b3041f0af14 · fixed in 40b4a7bb6b0b872b45f017dbf211268de098b75c; From 8fbf58e17dce8f250dda9ad6b0a49b3041f0af14 · fixed in af9a2bdaba0b4ceb0fc5e5122ef3fc6b7e5a366a; From 8fbf58e17dce8f250dda9ad6b0a49b3041f0af14 · fixed in cfec9e7f15a56cb0104bac13d01e5d11e1ba84fb; From 8fbf58e17dce8f250dda9ad6b0a49b3041f0af14 · fixed in 1a3670b6a6b5679fe56c5890157b344f091e64f8; From 8fbf58e17dce8f250dda9ad6b0a49b3041f0af14 · fixed in 4a17c73c83798c2fa9c7920ad5a98803adce3e01; From 8fbf58e17dce8f250dda9ad6b0a49b3041f0af14 · fixed in 8b2fd5c0aeda935294159206af9d6179282d425a; From 8fbf58e17dce8f250dda9ad6b0a49b3041f0af14 · fixed in 961e2a17c5e3559b3f8654d2daabdd25a42e770a

  • Linux Linux

    5.10

  • KernelLinux

    From 5.10.0 · fixed in 5.10.271; From 5.11.0 · fixed in 5.15.222; From 5.16.0 · fixed in 6.1.189; From 6.2.0 · fixed in 6.6.158; From 6.7.0 · fixed in 6.12.111; From 6.13.0 · fixed in 6.18.53; From 6.19.0 · fixed in 7.2.7

References 8

git.kernel.org