https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 29 Sep 2026 00:46:44 +0000 https://vulnerability.circl.lu/vuln/cve-2026-97574 <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>bnxt_en: Don&#39;t free the live ring&#39;s TPA state on queue restart failure</p> <p>bnxt_queue_mem_alloc() shallow copies the live RX ring into the clone:</p> <p>memcpy(clone, rxr, sizeof(*rxr));</p> <p>the code currently clears pointers that the clone owns (such as rx_agg_bmap), but rx_tpa and rx_tpa_idx_map are left pointing at memory of the live ring that was cloned.</p> <p>If an allocation failure happens later and the err_free_tpa_info label is taken, the live ring&#39;s memory can be freed while still in use.</p> <p>Fix this by initializing the clone&#39;s pointers to NULL to prevent live ring state from being freed inadvertently.</p> <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>bnxt_en: Don&#39;t free the live ring&#39;s TPA state on queue restart failure</p> <p>bnxt_queue_mem_alloc() shallow copies the live RX ring into the clone:</p> <p>memcpy(clone, rxr, sizeof(*rxr));</p> <p>the code currently clears pointers that the clone owns (such as rx_agg_bmap), but rx_tpa and rx_tpa_idx_map are left pointing at memory of the live ring that was cloned.</p> <p>If an allocation failure happens later and the err_free_tpa_info label is taken, the live ring&#39;s memory can be freed while still in use.</p> <p>Fix this by initializing the clone&#39;s pointers to NULL to prevent live ring state from being freed inadvertently.</p> https://vulnerability.circl.lu/vuln/cve-2026-97574