CVE-2026-74269 - Vulnerability Details

- bnxt: fix head underflow on XDP head-grow

Description

In the Linux kernel, the following vulnerability has been resolved:

bnxt: fix head underflow on XDP head-grow

The xdp.py test test_xdp_native_adjst_head_grow_data crashes when run on
a bnxt machine (and also crashes in NIPA).

It seems that the bug is an underflow in bnxt_rx_multi_page_skb, which
builds the skb head:

napi_build_skb(data_ptr - bp->rx_offset, rxr->rx_page_size);

The problem with this expression is that in page mode, rx_offset is:

bp->rx_offset = NET_IP_ALIGN + XDP_PACKET_HEADROOM;

Which evaluates (at least on x86_64) to 258.

The test test_xdp_native_adjst_head_grow_data tests a case where the
head is adjusted by -256.

When this test runs, data_ptr is shifted to frag_start + 2 (where
frag_start = page_address(page) + offset).

Then, bnxt_rx_multi_page_skb is invoked and the napi_build_skb
expression subtracts 258, landing at an address before frag_start. This
could be either the previous fragment or the previous physical page when
the offset is < 256 (e.g. if the fragment started at offset 0).

When the skb is freed, the page pool fragment reference is dropped on
either the wrong page or the wrong frag of the right page. In either
case, the corrupted reference count can lead to the page being
prematurely recycled while still in use. Once (incorrectly) recycled, it
can be handed out again and on driver teardown this would result in a
double free.

The commit under fixes updated this code to handle the case where the
native page size is >= 64k, but it unintentionally broke the head grow
case.

To fix this, add an offset field to struct bnxt_sw_rx_bd, mirroring the
existing offset field in struct bnxt_sw_rx_agg_bd. Populate it on
allocation and preserve it on reuse.

In bnxt_rx_multi_page_skb, use the newly added offset field to compute
the fragment start and pass that to napi_build_skb. Adjust the layout
with skb_reserve.

There are two cases, the non-adjustment case and the adjustment case.

In both cases, the skb is built at page_address(page) + offset to
account for the case where the native page size >= 64K and skb_reserve
is called with data_ptr - (page_address(page) + offset). That
difference equals bp->rx_offset when data_ptr was not moved, or
bp->rx_offset + xdp_adjust when XDP adjusted the head.

Re-running the failing test with this commit applied causes the test to
run successfully to completion.

The other rx_skb_func implementations don't have this issue.

Published: 2026-08-15

Score: 9.8 Critical

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The bnxt driver contains an integer underflow that occurs during XDP header growth, causing the driver to calculate an incorrect page boundary when constructing an skb. This underflow can corrupt reference counts, leading to pages being freed while still in use. When the driver later attempts to teardown, the corrupted page references may trigger a double free, which can result in a kernel crash or denial of service.

Affected Systems

The flaw is present in all Linux kernels that include the bnxt driver (Linux Linux). No specific version ranges are listed, so all current kernels using the bnxt driver are potentially affected.

Risk and Exploitability

The CVSS score of 9.8 denotes critical severity, and the EPSS score of <1% together with the absence from the CISA KEV catalog suggest that exploitation is currently unlikely. The description indicates that the underflow occurs when XDP header adjustments are performed, so a likely attack vector is an attacker sending crafted XDP packets to a bnxt interface; this inference is based on the context of the vulnerability. Once the underflow is triggered, the corrupted reference counts may cause a double free and kernel panic, which could lead to denial of service.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`f6974b4c2d8e1062b5a52228ee47293c15b4ee1e`	affected	< bb72b1c6755631c74b7e0878ee55bb81c06776c0
`f6974b4c2d8e1062b5a52228ee47293c15b4ee1e`	affected	< e26657fe3b85c068b01f42bb0c602f242d643ba9
`e9f11bfc03fb0d3c86f91b8ae945bb10f7e19c16`	affected	—
`ae0e135dc900827687ecc684c2bbb57aae48d318`	affected	—
`6.1.45`	affected	< 6.2
`6.4.10`	affected	< 6.5

Linux

affected

Version	Status	Constraints
`6.5`	affected	—
`0`	unaffected	< 6.5
`7.1.5`	unaffected	≤ 7.1.*
`7.2`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[f6974b4c2d8e1062b5a52228ee47293c15b4ee1e,bb72b1c6755631c74b7e0878ee55bb81c06776c0)`	affected	code_commit	—
`[f6974b4c2d8e1062b5a52228ee47293c15b4ee1e,e26657fe3b85c068b01f42bb0c602f242d643ba9)`	affected	code_commit	—
`[e9f11bfc03fb0d3c86f91b8ae945bb10f7e19c16,*]`	affected	code_commit	—
`[ae0e135dc900827687ecc684c2bbb57aae48d318,*]`	affected	code_commit	—
`[6.1.45,6.2)`	affected	semver	—
`[6.4.10,6.5)`	affected	semver	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[6.5,*]`	affected	generic	—
`[0,6.5)`	unaffected	semver	—
`[7.1.5,7.2.0)`	unaffected	semver	—
`[7.2-rc1,*]`	unaffected	semver	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Apply a kernel update that contains the patch removing the underflow in bnxt_rx_multi_page_skb
If an update cannot be applied immediately, disable XDP header adjustments or XDP on bnxt devices to prevent the vulnerable code path from executing
Apply the upstream commit (bb72b1c6755631c74b7e0878ee55bb81c06776c0 or e26657fe3b85c068b01f42bb0c602f242d643ba9) to the kernel source and rebuild the module

Generated by OpenCVE AI on August 22, 2026 at 03:49 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.0038.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/bb72b1c6755631c74b7e0878ee55bb81c06776c0
https://git.kernel.org/stable/c/e26657fe3b85c068b01f42bb0c602f242d643ba9
https://lore.kernel.org/linux-cve-announce/2026081543-CVE-2026-74269-29cf@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-74269
https://www.cve.org/CVERecord?id=CVE-2026-74269

History

Sat, 22 Aug 2026 02:45:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-119 CWE-416

Fri, 21 Aug 2026 00:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-124
References		https://lore.kernel.org/linux-cve-announce/2026081543-CVE-2026-74269-29cf@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-74269 https://www.cve.org/CVERecord?id=CVE-2026-74269
Metrics	threat_severity `None`	threat_severity `Important`

Mon, 17 Aug 2026 16:45:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-119 CWE-416

Mon, 17 Aug 2026 10:30:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-190 CWE-416

Mon, 17 Aug 2026 06:00:00 +0000

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}`

Sat, 15 Aug 2026 13:00:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-190 CWE-416

Sat, 15 Aug 2026 06:15:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: bnxt: fix head underflow on XDP head-grow The xdp.py test test_xdp_native_adjst_head_grow_data crashes when run on a bnxt machine (and also crashes in NIPA). It seems that the bug is an underflow in bnxt_rx_multi_page_skb, which builds the skb head: napi_build_skb(data_ptr - bp->rx_offset, rxr->rx_page_size); The problem with this expression is that in page mode, rx_offset is: bp->rx_offset = NET_IP_ALIGN + XDP_PACKET_HEADROOM; Which evaluates (at least on x86_64) to 258. The test test_xdp_native_adjst_head_grow_data tests a case where the head is adjusted by -256. When this test runs, data_ptr is shifted to frag_start + 2 (where frag_start = page_address(page) + offset). Then, bnxt_rx_multi_page_skb is invoked and the napi_build_skb expression subtracts 258, landing at an address before frag_start. This could be either the previous fragment or the previous physical page when the offset is < 256 (e.g. if the fragment started at offset 0). When the skb is freed, the page pool fragment reference is dropped on either the wrong page or the wrong frag of the right page. In either case, the corrupted reference count can lead to the page being prematurely recycled while still in use. Once (incorrectly) recycled, it can be handed out again and on driver teardown this would result in a double free. The commit under fixes updated this code to handle the case where the native page size is >= 64k, but it unintentionally broke the head grow case. To fix this, add an offset field to struct bnxt_sw_rx_bd, mirroring the existing offset field in struct bnxt_sw_rx_agg_bd. Populate it on allocation and preserve it on reuse. In bnxt_rx_multi_page_skb, use the newly added offset field to compute the fragment start and pass that to napi_build_skb. Adjust the layout with skb_reserve. There are two cases, the non-adjustment case and the adjustment case. In both cases, the skb is built at page_address(page) + offset to account for the case where the native page size >= 64K and skb_reserve is called with data_ptr - (page_address(page) + offset). That difference equals bp->rx_offset when data_ptr was not moved, or bp->rx_offset + xdp_adjust when XDP adjusted the head. Re-running the failing test with this commit applied causes the test to run successfully to completion. The other rx_skb_func implementations don't have this issue.
Title		bnxt: fix head underflow on XDP head-grow
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/bb72b1c6755631c74b7e0878ee55bb81c06776c0 https://git.kernel.org/stable/c/e26657fe3b85c068b01f42bb0c602f242d643ba9

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-08-15T05:57:43.559Z

Updated: 2026-08-17T05:45:15.603Z

Reserved: 2026-08-15T05:44:03.878Z

Link: CVE-2026-74269

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-08-15T06:22:26.280

Modified: 2026-08-17T06:19:20.587

Link: CVE-2026-74269

Redhat

Severity : Important

Publid Date: 2026-08-15T00:00:00Z

Links: CVE-2026-74269 - Bugzilla

OpenCVE Enrichment

Updated: 2026-08-22T04:00:12Z

Weaknesses

CWE-124
Buffer Underwrite ('Buffer Underflow')

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object