HIGH Introduced in 6.15
bnxt TPH Deadlock
CVE-2026-74745
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
KernelScan AI4.1MEDIUM
01Description
In the Linux kernel, the following vulnerability has been resolved: eth: bnxt: avoid deadlock when canceling IRQ affinity notifier Unregistering IRQ affinity notifiers waits for the callback synchronously. bnxt takes the netdev instance lock in the notifier (to restart the queue) and cancels the work under the same lock. This may obviously deadlock. Move the restart to the async service task. The queue restart isn't super time sensitive. Store the new TPH tag, schedule the task. Safely canceling the service task is already ironed out. In bnxt_request_irq() the order of registering notifier, affinity and initial TPH programming has to be inverted. I think it was racy previously since user may trigger an update as soon as notifier is installed. There's a small known gap - if pcie_tph_get_cpu_st() fails at init and the target tag is 0 we may miss programming the entry. This does not seem worth fixing, the code has skip-on-failure all over the place, anyway.
02KernelScan AI Analysis
Risk summary
A local user with access to IRQ affinity controls can trigger a self-deadlock in the bnxt driver, hanging the kernel and causing a denial of service. The bug requires a TPH-capable bnxt NIC and specific timing. No data corruption or privilege escalation is possible.
Vulnerability analysis
The bnxt network driver can deadlock while tearing down network interrupts if an IRQ affinity update runs at the same time. The driver's notifier callback acquires a device lock to restart the receive queue, and the teardown path unregisters that notifier while holding the same lock. Because unregistration waits synchronously for the callback to complete, the two threads block each other permanently. The fix moves the queue-restart work from the callback into an asynchronous background task, so the notifier no longer takes the device lock and teardown can safely wait for it to finish. Triggering the flaw requires administrative privileges to change IRQ affinity or bring the interface down on a system with a TPH-capable Broadcom bnxt NIC.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| mainline | 6.15 | 7.2 | 51e96fa31f7e |
| 7.1 | 6.15 | 7.1.10 | 8b1118fc5a5d |