Vulnerability-Lookup

FKIE_CVE-2026-97573

Vulnerability from fkie_nvd - Published: 2026-09-25 11:17 - Updated: 2026-09-25 15:17

Severity

8.1 (High) - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Summary

In the Linux kernel, the following vulnerability has been resolved: bnxt_en: Handle buffer allocation failure in bnxt_rx_ring_reset() bnxt_rx_ring_reset() frees the ring buffers and then reallocates them, ignoring the result. bnxt_alloc_one_rx_ring() can fail in bnxt_alloc_one_tpa_info_data(), which returns -ENOMEM on the first failed allocation and leaves the remaining rxr->rx_tpa[] entries zeroed. The error isn't propagated up, so the loop in bnxt_rx_ring_reset continues and at the end the code re-enables TPA with partially unallocated rx_tpa array. This means that when the agg_id from hardware is mapped to a SW index in rxr->rx_tpa[], an uninitialized slot can be chosen which would hand a zero DMA address to the device. Fix this by falling back to a global reset, which is what the existing code already does when other functions fail, but unlike the other failure cases this particular failure has to return because TPA can't be re-enabled since the allocation failed.

References

	URL	Tags
	416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/1a3670b6a6b5679fe56c5890157b344f091e64f8
	416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/4a17c73c83798c2fa9c7920ad5a98803adce3e01
	416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/8b2fd5c0aeda935294159206af9d6179282d425a
	416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/961e2a17c5e3559b3f8654d2daabdd25a42e770a

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/broadcom/bnxt/bnxt.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "1a3670b6a6b5679fe56c5890157b344f091e64f8",
              "status": "affected",
              "version": "8fbf58e17dce8f250dda9ad6b0a49b3041f0af14",
              "versionType": "git"
            },
            {
              "lessThan": "4a17c73c83798c2fa9c7920ad5a98803adce3e01",
              "status": "affected",
              "version": "8fbf58e17dce8f250dda9ad6b0a49b3041f0af14",
              "versionType": "git"
            },
            {
              "lessThan": "8b2fd5c0aeda935294159206af9d6179282d425a",
              "status": "affected",
              "version": "8fbf58e17dce8f250dda9ad6b0a49b3041f0af14",
              "versionType": "git"
            },
            {
              "lessThan": "961e2a17c5e3559b3f8654d2daabdd25a42e770a",
              "status": "affected",
              "version": "8fbf58e17dce8f250dda9ad6b0a49b3041f0af14",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/broadcom/bnxt/bnxt.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.10"
            },
            {
              "lessThan": "5.10",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.111",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.53",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.7",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc3",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbnxt_en: Handle buffer allocation failure in bnxt_rx_ring_reset()\n\nbnxt_rx_ring_reset() frees the ring buffers and then reallocates them,\nignoring the result.\n\nbnxt_alloc_one_rx_ring() can fail in bnxt_alloc_one_tpa_info_data(), which\nreturns -ENOMEM on the first failed allocation and leaves the remaining\nrxr-\u003erx_tpa[] entries zeroed.\n\nThe error isn\u0027t propagated up, so the loop in bnxt_rx_ring_reset\ncontinues and at the end the code re-enables TPA with partially\nunallocated rx_tpa array.\n\nThis means that when the agg_id from hardware is mapped to a SW index in\nrxr-\u003erx_tpa[], an uninitialized slot can be chosen which would hand a\nzero DMA address to the device.\n\nFix this by falling back to a global reset, which is what the existing\ncode already does when other functions fail, but unlike the other\nfailure cases this particular failure has to return because TPA can\u0027t\nbe re-enabled since the allocation failed."
    }
  ],
  "id": "CVE-2026-97573",
  "lastModified": "2026-09-25T15:17:59.440",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "HIGH",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 8.1,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 2.2,
        "impactScore": 5.9,
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "type": "Secondary"
      }
    ]
  },
  "published": "2026-09-25T11:17:08.017",
  "references": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/1a3670b6a6b5679fe56c5890157b344f091e64f8"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/4a17c73c83798c2fa9c7920ad5a98803adce3e01"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/8b2fd5c0aeda935294159206af9d6179282d425a"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/961e2a17c5e3559b3f8654d2daabdd25a42e770a"
    }
  ],
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
  "vulnStatus": "Received"
}

CVE-2026-97573 (GCVE-0-2026-97573)

Vulnerability from cvelistv5 – Published: 2026-09-25 10:21 – Updated: 2026-09-25 14:41

Title

bnxt_en: Handle buffer allocation failure in bnxt_rx_ring_reset()

Summary

Severity

8.1 (High)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Assigner

Linux mitre root

References

4 references

URL	Tags
https://git.kernel.org/stable/c/1a3670b6a6b5679fe…
https://git.kernel.org/stable/c/4a17c73c83798c2fa…
https://git.kernel.org/stable/c/8b2fd5c0aeda93529…
https://git.kernel.org/stable/c/961e2a17c5e3559b3…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: 8fbf58e17dce8f250dda9ad6b0a49b3041f0af14 , < 1a3670b6a6b5679fe56c5890157b344f091e64f8 (git) Affected: 8fbf58e17dce8f250dda9ad6b0a49b3041f0af14 , < 4a17c73c83798c2fa9c7920ad5a98803adce3e01 (git) Affected: 8fbf58e17dce8f250dda9ad6b0a49b3041f0af14 , < 8b2fd5c0aeda935294159206af9d6179282d425a (git) Affected: 8fbf58e17dce8f250dda9ad6b0a49b3041f0af14 , < 961e2a17c5e3559b3f8654d2daabdd25a42e770a (git)
Linux	Linux	Affected: 5.10 Unaffected: 0 , < 5.10 (semver) Unaffected: 6.12.111 , ≤ 6.12.* (semver) Unaffected: 6.18.53 , ≤ 6.18.* (semver) Unaffected: 7.2.7 , ≤ 7.2.* (semver) Unaffected: 7.3-rc3 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/broadcom/bnxt/bnxt.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "1a3670b6a6b5679fe56c5890157b344f091e64f8",
              "status": "affected",
              "version": "8fbf58e17dce8f250dda9ad6b0a49b3041f0af14",
              "versionType": "git"
            },
            {
              "lessThan": "4a17c73c83798c2fa9c7920ad5a98803adce3e01",
              "status": "affected",
              "version": "8fbf58e17dce8f250dda9ad6b0a49b3041f0af14",
              "versionType": "git"
            },
            {
              "lessThan": "8b2fd5c0aeda935294159206af9d6179282d425a",
              "status": "affected",
              "version": "8fbf58e17dce8f250dda9ad6b0a49b3041f0af14",
              "versionType": "git"
            },
            {
              "lessThan": "961e2a17c5e3559b3f8654d2daabdd25a42e770a",
              "status": "affected",
              "version": "8fbf58e17dce8f250dda9ad6b0a49b3041f0af14",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/broadcom/bnxt/bnxt.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.10"
            },
            {
              "lessThan": "5.10",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.111",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.53",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.7",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc3",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.111",
                  "versionStartIncluding": "5.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.53",
                  "versionStartIncluding": "5.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.7",
                  "versionStartIncluding": "5.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3-rc3",
                  "versionStartIncluding": "5.10",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbnxt_en: Handle buffer allocation failure in bnxt_rx_ring_reset()\n\nbnxt_rx_ring_reset() frees the ring buffers and then reallocates them,\nignoring the result.\n\nbnxt_alloc_one_rx_ring() can fail in bnxt_alloc_one_tpa_info_data(), which\nreturns -ENOMEM on the first failed allocation and leaves the remaining\nrxr-\u003erx_tpa[] entries zeroed.\n\nThe error isn\u0027t propagated up, so the loop in bnxt_rx_ring_reset\ncontinues and at the end the code re-enables TPA with partially\nunallocated rx_tpa array.\n\nThis means that when the agg_id from hardware is mapped to a SW index in\nrxr-\u003erx_tpa[], an uninitialized slot can be chosen which would hand a\nzero DMA address to the device.\n\nFix this by falling back to a global reset, which is what the existing\ncode already does when other functions fail, but unlike the other\nfailure cases this particular failure has to return because TPA can\u0027t\nbe re-enabled since the allocation failed."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The fixed function bnxt_rx_ring_reset() is a driver error path with no malformed input. What it damages is received data: bnxt_tpa_start() hands the NIC a stale rx_tpa[] mapping, and the NIC DMAs packet bytes sent by a remote host into that freed buffer. The remote peer supplies the data that gets written, so the vector is Network.\nAC:H - Two things must happen together. A pre-P5 chip must hit an RX buffer error, cons mismatch or ring-monitor event that schedules the per-ring reset, and the GFP_KERNEL refill in bnxt_alloc_one_tpa_info_data() must fail under memory pressure. A remote sender cannot force that allocation failure.\nPR:N - No authentication is involved. Any host that can send TCP traffic that the NIC aggregates with TPA (hardware GRO/LRO) fills the stale buffers and can also generate the traffic that leads to RX buffer errors.\nUI:N - No user action is needed. The reset runs from the bnxt sp_task workqueue, and the bad TPA slot is used as soon as TPA_START completions arrive.\nS:U - The corruption hits kernel memory on the host that owns the NIC, which is the same authority as the driver. No VM or other security boundary is crossed.\nC:H - bnxt_free_one_tpa_info_data() clears tpa_info-\u003edata but leaves tpa_info-\u003emapping stale. The NIC then writes into a page returned to page_pool that can be reused, and a reused buffer carrying other data can end up delivered as the next RX packet.\nI:H - The device DMA-writes TCP payload bytes chosen by the remote sender into freed memory (bnxt_tpa_start() puts the stale mapping into rx_bd_haddr). That is a write into memory the kernel may have reused, with attacker-chosen contents.\nA:H - The NULL tpa_info-\u003edata is moved into rx_buf_ring by bnxt_tpa_start(). When that buffer is consumed, the RX path dereferences NULL, and on top of that the stray DMA corrupts memory, so the kernel crashes."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-25T14:41:17.143Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/1a3670b6a6b5679fe56c5890157b344f091e64f8"
        },
        {
          "url": "https://git.kernel.org/stable/c/4a17c73c83798c2fa9c7920ad5a98803adce3e01"
        },
        {
          "url": "https://git.kernel.org/stable/c/8b2fd5c0aeda935294159206af9d6179282d425a"
        },
        {
          "url": "https://git.kernel.org/stable/c/961e2a17c5e3559b3f8654d2daabdd25a42e770a"
        }
      ],
      "title": "bnxt_en: Handle buffer allocation failure in bnxt_rx_ring_reset()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-97573",
    "datePublished": "2026-09-25T10:21:57.443Z",
    "dateReserved": "2026-09-24T16:01:01.156Z",
    "dateUpdated": "2026-09-25T14:41:17.143Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

FKIE_CVE-2026-97573

CVE-2026-97573 (GCVE-0-2026-97573)

Tags

Sightings

Nomenclature

Related by attack behaviour