CVE-2026-97572

Received Received - Intake

BaseFortify

Publication date: 2026-09-25

Last updated on: 2026-10-03

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: bnxt_en: Propagate RX ring init failures in bnxt_init_nic() bnxt_init_rx_rings() returns an error when bnxt_alloc_one_rx_ring() fails, but bnxt_init_nic() discards that return value and calls bnxt_init_chip(), which enables TPA. If an allocation fails, this could leave rxr->rx_tpa[] partially zeroed and TPA would be enabled over an array with zeroed entries. This would lead to a zeroed DMA address being handed out if the agg_idx is translated to a SW index at a zeroed entry. Fix this by propagating the error out of bnxt_init_nic(). Both callers already check its return value and unwind with bnxt_free_skbs() and bnxt_free_mem(), which tolerate a partially initialized RX ring.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-25

Last Modified

2026-10-03

Generated

2026-10-15

AI Q&A

2026-09-25

EPSS Evaluated

2026-10-14

NVD

CVE-2026-97572

EUVD

EUVD-2026-86880

Affected Vendors & Products

Vendor	Product	Version / Range
Linux	Linux	c0c050c58d840994ba842ad1c338a98e7c12b764
Linux	Linux	c0c050c58d840994ba842ad1c338a98e7c12b764
Linux	Linux	c0c050c58d840994ba842ad1c338a98e7c12b764
Linux	Linux	c0c050c58d840994ba842ad1c338a98e7c12b764
Linux	Linux	c0c050c58d840994ba842ad1c338a98e7c12b764
Linux	Linux	c0c050c58d840994ba842ad1c338a98e7c12b764
Linux	Linux	c0c050c58d840994ba842ad1c338a98e7c12b764
Linux	Linux	c0c050c58d840994ba842ad1c338a98e7c12b764
Linux	Linux	4.4

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel occurs in the bnxt_en driver. When initializing RX rings for network communication, a failure in memory allocation (bnxt_alloc_one_rx_ring) returns an error. However, the bnxt_init_nic function ignores this error and proceeds to enable TPA (TCP Segmentation Offload). This leaves part of the RX ring zeroed out, potentially causing a zeroed DMA address to be used if an invalid index is accessed.

Detection Guidance

This vulnerability is specific to the Linux kernel's bnxt_en driver and involves RX ring initialization failures. Detection requires checking kernel logs for bnxt_en related errors during NIC initialization or RX ring setup. Monitor dmesg or journalctl for messages about bnxt_init_nic() or bnxt_init_rx_rings() failures.

Impact Analysis

This flaw could lead to system instability or crashes if a zeroed DMA address is used, causing memory corruption or denial-of-service conditions. Attackers might exploit this to trigger kernel panics or gain unauthorized access to system resources.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards as it is a low-level Linux kernel driver issue involving RX ring initialization failures in the bnxt_en network driver. Compliance impacts would depend on specific system configurations and usage, but the vulnerability itself is unrelated to data protection or privacy requirements.

Mitigation Strategies

Update the Linux kernel to a patched version that includes the fix for CVE-2026-97572. The patch ensures proper error propagation during RX ring initialization, preventing TPA from being enabled over partially zeroed arrays.

Hi! I’m here to help you understand CVE-2026-97572. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70