The Linux kernel bnxt_en driver contains a flaw where End of Frame padding (EOP), when enabled on the Aggregation ring, overlaps with the zero padding of a preceding segment if Relaxed Ordering (RO) is also enabled. Older chipset families such as P5 and earlier do not automatically turn off RO when EOP is active, allowing the zero padding to overwrite valid data in the following segment and corrupt the packet payload. This corruption can affect the integrity of network traffic. Affected systems include all Linux kernel installations that load the bnxt_en network driver on hardware employing P5 or older chips, particularly on ARM systems using the 57508 (P5) chip. The issue triggers only when TPA (Transport Packet Aggregation) is enabled and EOP is left active. No specific kernel version range is listed, but the resolution appears in recent commit history and can be applied to any affected kernel. Risk and exploitability are limited to local or privileged attackers who can influence network traffic on the vulnerable NIC. No public exploit code or exploitation guidance is currently documented, the EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. Still, the potential for data corruption drives a high integrity impact, making the patch the recommended mitigation.

Linux kernels that load the bnxt_en driver on P5 or earlier Ethernet hardware, especially ARM-based systems with the 57508 chip, represent the compromised configurations. Disabling TPA or the Relaxed Ordering feature on these devices is recommended if the patch cannot be applied. The vulnerability does not affect other kernel components or hardware families that do not use the bnxt_en driver or where EOP is never enabled. Positive identification of the affected platform requires inspecting the media driver configuration and the NIC model; updating to a kernel that includes the commit referencing the EOP disable fix resolves the issue.

Given the lack of external exploitation evidence, the threat remains largely theoretical but the integrity compromise is real for running processes that rely on correct packet delivery. The security impact is confined to processes bound to the affected NIC and userspace applications that process corrupted packets. Only privileged users or attackers with the ability to inject traffic to the NIC could exploit the flaw. Consequently, the risk is localized but severe enough to warrant immediate patching. In the absence of a publicly disclosed exploit, the EPSS score is unavailable, but the kernel vulnerability scores by the CNA suggest a critical importance. The vendor has not listed this flaw in the CISA KEV catalog, which is consistent with a mitigation that is purely a code fix. Proper mitigation eliminates the risk entirely; the patch disables EOP on all chips when TPA is enabled, preventing the overlapping padding scenario that lead to data corruption.