GHSA-675V-24QC-J383
Vulnerability from github – Published: 2026-09-25 12:31 – Updated: 2026-09-25 12:31In the Linux kernel, the following vulnerability has been resolved:
bnxt_en: Propagate RX ring init failures in bnxt_init_nic()
bnxt_init_rx_rings() returns an error when bnxt_alloc_one_rx_ring() fails, but bnxt_init_nic() discards that return value and calls bnxt_init_chip(), which enables TPA.
If an allocation fails, this could leave rxr->rx_tpa[] partially zeroed and TPA would be enabled over an array with zeroed entries. This would lead to a zeroed DMA address being handed out if the agg_idx is translated to a SW index at a zeroed entry.
Fix this by propagating the error out of bnxt_init_nic(). Both callers already check its return value and unwind with bnxt_free_skbs() and bnxt_free_mem(), which tolerate a partially initialized RX ring.
{
"affected": [],
"aliases": [
"CVE-2026-97572"
],
"database_specific": {
"cwe_ids": [],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-09-25T11:17:07Z",
"severity": null
},
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nbnxt_en: Propagate RX ring init failures in bnxt_init_nic()\n\nbnxt_init_rx_rings() returns an error when bnxt_alloc_one_rx_ring()\nfails, but bnxt_init_nic() discards that return value and calls\nbnxt_init_chip(), which enables TPA.\n\nIf an allocation fails, this could leave rxr-\u003erx_tpa[] partially zeroed\nand TPA would be enabled over an array with zeroed entries. This would\nlead to a zeroed DMA address being handed out if the agg_idx is\ntranslated to a SW index at a zeroed entry.\n\nFix this by propagating the error out of bnxt_init_nic(). Both callers\nalready check its return value and unwind with bnxt_free_skbs() and\nbnxt_free_mem(), which tolerate a partially initialized RX ring.",
"id": "GHSA-675v-24qc-j383",
"modified": "2026-09-25T12:31:25Z",
"published": "2026-09-25T12:31:25Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-97572"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/8e6a850c0746bb4be167aedf1ee57469fcda09a9"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/b4c40f2c80d7bf50648878bc206a39adfbfaec6c"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/daadccd062fdca5e77a8cc22ffe35857803b6c49"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/dfd73af81cdb9f7b399754a59e2658a08211bee5"
}
],
"schema_version": "1.4.0",
"severity": []
}
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.