bnxt_en RxRingReset Corruption

Vulnerability analysis

When a Broadcom bnxt network interface encounters buffer errors under heavy traffic, the driver performs a localized RX ring reset that frees and reallocates receive buffers. If the reallocation fails partway through due to memory pressure, the failure is silently ignored and packet aggregation is re-enabled with uninitialized buffer slots containing zero DMA addresses. The hardware can then select one of these uninitialized slots and attempt to DMA incoming packet data to physical address zero — either crashing the system via a DMA fault or corrupting kernel memory at that address with attacker-controlled packet content. The fix checks the allocation return value and, on failure, falls back to a full device reset instead of re-enabling aggregation with partially allocated buffers. This vulnerability is reachable only on systems equipped with a Broadcom bnxt network interface; a remote attacker can trigger the buffer errors by sending heavy traffic, but exploiting the missed allocation failure also depends on the system being under memory pressure when the ring reset occurs.