Executive Summary

This vulnerability exists in the Linux kernel's bnxt_en driver, where a NULL pointer dereference can occur during PCIe error recovery.

When PCIe errors are detected by a Root Port or Downstream Port, error recovery services run on all subordinate devices regardless of their administrative state.

The error_detected callback function, bnxt_io_error_detected(), disables and synchronizes interrupts by calling bnxt_disable_int_sync(), which maps completion rings to IRQs using a pointer called bp->bnapi.

Since bp->bnapi is allocated when the network interface card (NIC) is opened and freed when it is closed, if PCIe error recovery occurs on a closed NIC, the code may dereference a NULL pointer, leading to a potential crash or instability.

The fix involves checking if bp->bnapi is NULL before disabling and synchronizing IRQs to prevent this NULL pointer dereference.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can cause a NULL pointer dereference in the Linux kernel's network driver, which may lead to system crashes or instability during PCIe error recovery on network devices.

Such crashes can result in denial of service conditions, potentially disrupting network connectivity and affecting system availability.

Useful 0 Not Useful 0