CVE-2026-23041
NULL Pointer Dereference in Linux bnxt_en Driver Causes Crash
Publication date: 2026-02-04
Last updated on: 2026-02-04
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| broadcom | bnxt_en | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-UNKNOWN |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in the Linux kernel's Broadcom bnxt_en network driver. It occurs when the initialization function bnxt_init_one() fails, triggering an error cleanup path that frees hardware resources and sets a DMA pool pointer to NULL. Later, during cleanup, the function bnxt_ptp_clear() calls ptp_clock_unregister(), which disables PTP events by calling the driver's enable callback bnxt_ptp_enable(). This callback tries to send hardware commands that require accessing the DMA pool, but since the pool pointer is NULL, it causes a NULL pointer dereference and a kernel crash.
The root cause is that ptp_clock_unregister() calls ptp_disable_all_events(), which calls bnxt_ptp_enable() after the DMA pool has already been freed, leading to the NULL pointer dereference. The fix involves clearing and unregistering the PTP clock before freeing the hardware resources.
How can this vulnerability impact me? :
This vulnerability can cause a NULL pointer dereference in the Linux kernel, leading to a kernel crash (panic) or system instability when the bnxt_en network driver encounters an initialization failure. This can result in denial of service (DoS) conditions on affected systems, potentially disrupting network connectivity and impacting system availability.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
I don't know
What immediate steps should I take to mitigate this vulnerability?
The vulnerability is fixed by ensuring that the ptp (Precision Time Protocol) is cleared and unregistered before freeing HWRM resources in the bnxt driver.
Specifically, the fix involves calling bnxt_ptp_clear() before bnxt_free_hwrm_resources() during error cleanup in the bnxt driver initialization process.
To mitigate this vulnerability immediately, update your Linux kernel to a version that includes this fix (post commit f8f9c1f4d0c7, Linux 6.19-rc3 or later).