CVE-2026-97574

Received Received - Intake

BaseFortify

Publication date: 2026-09-25

Last updated on: 2026-10-03

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: bnxt_en: Don't free the live ring's TPA state on queue restart failure bnxt_queue_mem_alloc() shallow copies the live RX ring into the clone: memcpy(clone, rxr, sizeof(*rxr)); the code currently clears pointers that the clone owns (such as rx_agg_bmap), but rx_tpa and rx_tpa_idx_map are left pointing at memory of the live ring that was cloned. If an allocation failure happens later and the err_free_tpa_info label is taken, the live ring's memory can be freed while still in use. Fix this by initializing the clone's pointers to NULL to prevent live ring state from being freed inadvertently.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-25

Last Modified

2026-10-03

Generated

2026-10-16

AI Q&A

2026-09-25

EPSS Evaluated

2026-10-14

NVD

CVE-2026-97574

EUVD

EUVD-2026-86882

Affected Vendors & Products

Vendor	Product	Version / Range
Linux	Linux	0997443906b96a051011f220a61e6dce4602ec54
Linux	Linux	bd649c5cc958169b8a8a3e77ea926d92d472b02a
Linux	Linux	bd649c5cc958169b8a8a3e77ea926d92d472b02a
Linux	Linux	bd649c5cc958169b8a8a3e77ea926d92d472b02a
Linux	Linux	6.12.20
Linux	Linux	6.13

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves a memory management issue in the bnxt_en driver. When a RX ring clone is created, it incorrectly retains pointers to the live ring's memory. If an allocation failure occurs later, the live ring's memory may be freed while still in use, leading to potential crashes or data corruption.

Detection Guidance

This vulnerability is specific to the Linux kernel's bnxt_en driver and may not have direct detection commands. Monitor kernel logs for bnxt_en related errors or crashes, particularly during RX ring operations. Check for messages indicating TPA state issues or memory corruption in the driver.

Impact Analysis

This vulnerability could cause system instability, crashes, or data corruption if exploited. Systems using affected Linux kernel versions with the bnxt_en driver may experience network-related failures or unexpected behavior.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards as it pertains to a Linux kernel driver issue that could lead to memory corruption or use-after-free conditions. Compliance impacts would depend on how the affected system is used and whether it processes sensitive data.

Mitigation Strategies

Update your Linux kernel to the latest patched version that includes the fix for CVE-2026-97574. If immediate patching is not possible, consider disabling the bnxt_en driver if not in use or restricting network interfaces to reduce exposure.

Hi! I’m here to help you understand CVE-2026-97574. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70