The Linux kernel bnxt_en driver contains a flaw where enabling End‑of‑Frame padding (EOP) on the aggregation ring while Relaxed Ordering (RO) is active on older P5 or earlier Ethernet chipsets can cause zero‐padding from one packet segment to overwrite data in the next segment. This results in corrupted network traffic payloads and a loss of data integrity. The weakness is a *CWE-805* buffer access with incorrect length value.

Linux kernels that load the bnxt_en driver on older P5‑class or earlier Ethernet hardware, particularly ARM‑based systems using the 57508 chip, are affected; versions prior to the patch that disables EOP when TPA is enabled on these chipsets represent the vulnerable configurations.

The CVSS score of 8.2 indicates a high severity, but the EPSS score of less than 1 % shows a very low likelihood of exploitation at this time, and the vulnerability is not listed in CISA’s KEV catalog. An attacker would need to craft packet traffic that is processed by the affected bnxt_en driver with EOP and TPA enabled on a chip that does not automatically suppress RO; the exploit would result in data corruption rather than arbitrary code execution. Because the flaw requires specific firmware and driver states, the risk remains theoretical until a proof‑of‑concept is demonstrated, but mitigations should be deployed promptly.