GHSA-J77V-WXHH-GW5H
Vulnerability from github – Published: 2026-09-25 12:31 – Updated: 2026-09-25 15:31In the Linux kernel, the following vulnerability has been resolved:
bnxt_en: Bound SW TPA IDs to prevent crashes
FW supports up to 1024 concurrent TPAs, so the FW TPA ID is in the range 0..1023 (see commit ec4d8e7cf024 ("bnxt_en: Add TPA ID mapping logic for 57500 chips.")). bnxt_alloc_agg_idx is intended to wrap the FW ID down to a software ID which is used to index rxr->rx_tpa, and to generate a mapping between FW IDs and the wrapped software ID.
On a 57608 with firmware version 233, the firmware advertises 32 concurrent TPAs. As of the commit under fixes, bp->max_tpa on this NIC is set to 32.
If the software ID from bnxt_alloc_agg_idx is above 31, this results in an invalid address being loaded on this line:
tpa_info = &rxr->rx_tpa[agg_id];
because rx_tpa is allocated with only bp->max_tpa (32) entries. Writes to tpa_info later in the code are out of bounds.
This bug results in a crash at boot:
Oops: general protection fault, kernel NULL pointer dereference 0x8: 0000 [#1] SMP NOPTI RIP: 0010:bnxt_rx_pkt+0xc0/0x1560 RSP: 0018:ffffc900009b8c78 EFLAGS: 00010246 RAX: 0000000000000000 RBX: 0000000000000048 RCX: 0000000206682516 RDX: ffffc900009b8db4 RSI: 0000000000000000 RDI: 01ffffff038fe1c0 RBP: ffffc9006e687480 R08: ffffc9006e687000 R09: 0000000000003048 R10: 0000000000000480 R11: ffff8881c6083900 R12: 0000000006682516 R13: ffff8881c6095400 R14: 0000000000000016 R15: ffff8881c6b66680 FS: 0000000000000000(0000) GS:ffff88fef3c77000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007fc8bda40584 CR3: 000000807c812001 CR4: 0000000008772ef0 PKRU: 55555554 Call Trace: ? __netif_receive_skb_list_core+0x1ca/0x250 __bnxt_poll_work+0x152/0x280 bnxt_poll_p5+0x1cd/0x480 __napi_poll+0x30/0x180 net_rx_action+0x20b/0x3b0 ? note_gp_changes+0x53/0xe0 ? tick_setup_sched_timer+0x180/0x180 ? __napi_schedule+0x9a/0xb0 ? bnxt_msix+0x24/0x30 handle_softirqs+0xdd/0x2c0 __irq_exit_rcu.llvm.3171231171502365008+0x47/0xf0 common_interrupt+0x85/0x90 asm_common_interrupt+0x22/0x40
This stack trace is from a crash triggered when an out of bounds rx_tpa is dereferenced. The invalid write mentioned above is silent in this particular crash.
Fix this by allocating rx_tpa with bp->max_tpa rounded up to the next power of 2 (bp->max_tpa_roundup_size) entries and masking the FW TPA ID with that size, so the wrapped ID can never index past the end of the array.
{
"affected": [],
"aliases": [
"CVE-2026-97570"
],
"database_specific": {
"cwe_ids": [],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-09-25T11:17:07Z",
"severity": "HIGH"
},
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nbnxt_en: Bound SW TPA IDs to prevent crashes\n\nFW supports up to 1024 concurrent TPAs, so the FW TPA ID is in the range\n0..1023 (see commit ec4d8e7cf024 (\"bnxt_en: Add TPA ID mapping logic for\n57500 chips.\")). bnxt_alloc_agg_idx is intended to wrap the FW ID down to a\nsoftware ID which is used to index rxr-\u003erx_tpa, and to generate a mapping\nbetween FW IDs and the wrapped software ID.\n\nOn a 57608 with firmware version 233, the firmware advertises 32\nconcurrent TPAs. As of the commit under fixes, bp-\u003emax_tpa on this NIC\nis set to 32.\n\nIf the software ID from bnxt_alloc_agg_idx is above 31, this results in\nan invalid address being loaded on this line:\n\n tpa_info = \u0026rxr-\u003erx_tpa[agg_id];\n\nbecause rx_tpa is allocated with only bp-\u003emax_tpa (32) entries. Writes\nto tpa_info later in the code are out of bounds.\n\nThis bug results in a crash at boot:\n\nOops: general protection fault, kernel NULL pointer dereference 0x8: 0000 [#1] SMP NOPTI\nRIP: 0010:bnxt_rx_pkt+0xc0/0x1560\nRSP: 0018:ffffc900009b8c78 EFLAGS: 00010246\nRAX: 0000000000000000 RBX: 0000000000000048 RCX: 0000000206682516\nRDX: ffffc900009b8db4 RSI: 0000000000000000 RDI: 01ffffff038fe1c0\nRBP: ffffc9006e687480 R08: ffffc9006e687000 R09: 0000000000003048\nR10: 0000000000000480 R11: ffff8881c6083900 R12: 0000000006682516\nR13: ffff8881c6095400 R14: 0000000000000016 R15: ffff8881c6b66680\nFS: 0000000000000000(0000) GS:ffff88fef3c77000(0000) knlGS:0000000000000000\nCS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 00007fc8bda40584 CR3: 000000807c812001 CR4: 0000000008772ef0\nPKRU: 55555554\nCall Trace:\n \u003cIRQ\u003e\n ? __netif_receive_skb_list_core+0x1ca/0x250\n __bnxt_poll_work+0x152/0x280\n bnxt_poll_p5+0x1cd/0x480\n __napi_poll+0x30/0x180\n net_rx_action+0x20b/0x3b0\n ? note_gp_changes+0x53/0xe0\n ? tick_setup_sched_timer+0x180/0x180\n ? __napi_schedule+0x9a/0xb0\n ? bnxt_msix+0x24/0x30\n handle_softirqs+0xdd/0x2c0\n __irq_exit_rcu.llvm.3171231171502365008+0x47/0xf0\n common_interrupt+0x85/0x90\n \u003c/IRQ\u003e\n \u003cTASK\u003e\n asm_common_interrupt+0x22/0x40\n\nThis stack trace is from a crash triggered when an out of bounds rx_tpa\nis dereferenced. The invalid write mentioned above is silent in this\nparticular crash.\n\nFix this by allocating rx_tpa with bp-\u003emax_tpa rounded up to the next\npower of 2 (bp-\u003emax_tpa_roundup_size) entries and masking the FW TPA ID\nwith that size, so the wrapped ID can never index past the end of the\narray.",
"id": "GHSA-j77v-wxhh-gw5h",
"modified": "2026-09-25T15:31:42Z",
"published": "2026-09-25T12:31:24Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-97570"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/05cf64d171772c65bcdee76ee7163c35d9f55a89"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/c0aceaf65b70b3c000e70dd867f3a673015f24ca"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.