CVE-2026-97573bnxt_en: Handle buffer allocation failure in bnxt_rx_ring_reset()
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: bnxt_en: Handle buffer allocation failure in bnxt_rx_ring_reset() bnxt_rx_ring_reset() frees the ring buffers and then reallocates them, ignoring the result. bnxt_alloc_one_rx_ring() can fail in bnxt_alloc_one_tpa_info_data(), which returns -ENOMEM on the first failed allocation and leaves the remaining rxr->rx_tpa[] entries zeroed. The error isn't propagated up, so the loop in bnxt_rx_ring_reset continues and at the end the code re-enables TPA with partially unallocated rx_tpa array. This means that when the agg_id from hardware is mapped to a SW index in rxr->rx_tpa[], an uninitialized slot can be chosen which would hand a zero DMA address to the device. Fix this by falling back to a global reset, which is what the existing code already does when other functions fail, but unlike the other failure cases this particular failure has to return because TPA can't be re-enabled since the allocation failed.
- CVSS
- 8.1 HIGH (v3.1, CNA)CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Oct 3, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from 8fbf58e17dce8f250dda9ad6b0a49b3041f0af14 before 52fc97cbc3ba118aad84e7c001bf02ebe8496f70; from 8fbf58e17dce8f250dda9ad6b0a49b3041f0af14 before 40b4a7bb6b0b872b45f017dbf211268de098b75c; from 8fbf58e17dce8f250dda9ad6b0a49b3041f0af14 before af9a2bdaba0b4ceb0fc5e5122ef3fc6b7e5a366a; from 8fbf58e17dce8f250dda9ad6b0a49b3041f0af14 before cfec9e7f15a56cb0104bac13d01e5d11e1ba84fb; 8fbf58e17dce8f250dda9ad6b0a49b3041f0af14 builds before 1a3670b6a6b5679fe56c5890157b344f091e64f8; 8fbf58e17dce8f250dda9ad6b0a49b3041f0af14 builds before 4a17c73c83798c2fa9c7920ad5a98803adce3e01; 8fbf58e17dce8f250dda9ad6b0a49b3041f0af14 builds before 8b2fd5c0aeda935294159206af9d6179282d425a; from 8fbf58e17dce8f250dda9ad6b0a49b3041f0af14 before 961e2a17c5e3559b3f8654d2daabdd25a42e770a | CNA record |
References
- https://git.kernel.org/stable/c/52fc97cbc3ba118aad84e7c001bf02ebe8496f70
- https://git.kernel.org/stable/c/40b4a7bb6b0b872b45f017dbf211268de098b75c
- https://git.kernel.org/stable/c/af9a2bdaba0b4ceb0fc5e5122ef3fc6b7e5a366a
- https://git.kernel.org/stable/c/cfec9e7f15a56cb0104bac13d01e5d11e1ba84fb
- https://git.kernel.org/stable/c/1a3670b6a6b5679fe56c5890157b344f091e64f8
- https://git.kernel.org/stable/c/4a17c73c83798c2fa9c7920ad5a98803adce3e01
- https://git.kernel.org/stable/c/8b2fd5c0aeda935294159206af9d6179282d425a
- https://git.kernel.org/stable/c/961e2a17c5e3559b3f8654d2daabdd25a42e770a
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.