CVE-2026-97573
Received Received - Intake

Buffer Allocation Failure in Linux Kernel bnxt_en Driver

Publication date: 2026-09-25

Last updated on: 2026-09-25

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: bnxt_en: Handle buffer allocation failure in bnxt_rx_ring_reset() bnxt_rx_ring_reset() frees the ring buffers and then reallocates them, ignoring the result. bnxt_alloc_one_rx_ring() can fail in bnxt_alloc_one_tpa_info_data(), which returns -ENOMEM on the first failed allocation and leaves the remaining rxr->rx_tpa[] entries zeroed. The error isn't propagated up, so the loop in bnxt_rx_ring_reset continues and at the end the code re-enables TPA with partially unallocated rx_tpa array. This means that when the agg_id from hardware is mapped to a SW index in rxr->rx_tpa[], an uninitialized slot can be chosen which would hand a zero DMA address to the device. Fix this by falling back to a global reset, which is what the existing code already does when other functions fail, but unlike the other failure cases this particular failure has to return because TPA can't be re-enabled since the allocation failed.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-25
Last Modified
2026-09-25
Generated
2026-09-25
AI Q&A
2026-09-25
EPSS Evaluated
N/A
NVD
CVE-2026-97573
EUVD
EUVD-2026-86881

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a Linux kernel vulnerability in the Broadcom NetXtreme Ethernet driver (bnxt_en). The issue occurs in the bnxt_rx_ring_reset() function, which fails to handle memory allocation errors properly. When allocating ring buffers, if any allocation fails, the function continues without propagating the error, leading to partially unallocated resources. This can cause the driver to use uninitialized memory, potentially handing a zero DMA address to hardware, which may result in undefined behavior or crashes.

Detection Guidance

This vulnerability is specific to the Linux kernel's bnxt_en driver and involves buffer allocation failures in bnxt_rx_ring_reset(). Detection requires checking kernel logs for errors related to bnxt_en or buffer allocation failures during network operations. Look for messages indicating DMA address issues or TPA (TCP Segmentation Offload) problems in system logs.

Impact Analysis

If exploited, this vulnerability could cause system instability, crashes, or denial of service due to improper memory handling. It may also lead to data corruption or unauthorized access if the zero DMA address triggers unexpected hardware behavior. Systems using affected Broadcom network adapters are at risk.

Mitigation Strategies

Immediate mitigation involves updating the Linux kernel to a patched version that includes the fix for this vulnerability. Check your distribution's security advisories for kernel updates addressing CVE-2026-97573. If updating is not immediately possible, consider disabling the bnxt_en driver or the affected network interface if not critical.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-97573. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart