HIGH
bnxt_en TpaInfo Corruption
CVE-2026-97571
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
01Description
In the Linux kernel, the following vulnerability has been resolved: bnxt_en: Propagate TPA buffer allocation failures in bnxt_queue_mem_alloc() bnxt_alloc_one_tpa_info_data() returns -ENOMEM as soon as one allocation fails. This leaves the remaining rxr->rx_tpa[] entries zeroed. bnxt_queue_mem_alloc() discards that return value, so the partially initialized ring is installed by bnxt_queue_start(). Since the agg_id is picked by the hardware and bnxt_alloc_agg_idx maps it to a SW index in rxr->rx_tpa[], it is possible that an uninitialized slot can be chosen which would hand a zero DMA address to the device. Fix this by checking the return value of bnxt_alloc_one_tpa_info_data and unwinding, freeing the ring buffers.
02KernelScan AI Analysis
Risk summary
A partial memory allocation failure in the Broadcom NetXtreme driver's TPA buffer setup leaves some entries uninitialized but still activates the receive ring. Incoming network traffic can then cause the hardware to use an uninitialized entry, handing a zero DMA address to the device and potentially causing memory corruption or a system crash. Systems with Broadcom NetXtreme NICs receiving network traffic are at risk.
Vulnerability analysis
When the Broadcom NetXtreme driver sets up receive ring buffers for TPA (Transparent Packet Aggregation), a partial memory allocation failure leaves some TPA buffer entries zeroed, but the ring is still activated as if fully initialized. If the network hardware later selects one of these uninitialized entries while processing incoming traffic, a zero DMA address is handed to the device, which can cause memory corruption or a device crash. The fix checks the allocation return value and, on failure, unwinds by freeing the already-allocated buffers before propagating the error, preventing the partially initialized ring from being installed. This requires a Broadcom NetXtreme NIC and is triggered when memory allocation fails during ring setup followed by incoming network traffic; an attacker sending network traffic to the interface can trigger the issue once the system is in the partially initialized state, though the attacker cannot directly control when the allocation failure occurs.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 6.12 | 6.12.20 | 6.12.112 | d7db2e4953e4 |
| 6.18 | — | 6.18.53 | c8050386a220 |
| 7.2 | — | 7.2.7 | 37e08dc821a5 |
| mainline | — | 7.3-rc3 | b814dfbfeb0a |