The bnxt network driver in the Linux kernel contains a deadlock issue that occurs when an IRQ affinity notifier is unregistered. The callback executed during unregistration holds the netdev instance lock and then attempts to cancel work under the same lock. Because the work cancellation and queue restart happen while the lock is still held, the system can enter a deadlock, halting network packet processing and potentially causing the driver to become unresponsive.

Any Linux kernel build that includes the pre‑patch version of the bnxt driver is vulnerable. Systems using older kernel releases that have not yet incorporated the commit that reverses the notifier registration order and moves the queue restart to a separate service task are at risk.

The vulnerability has a CVSS score of 7.5 and an EPSS score of < 1%, indicating a very low probability of exploitation. It is not listed in the CISA KEV catalog, indicating no known public exploitation. Exploitation would likely require an attacker to trigger a driver unload or reload with privileged kernel access, making remote unauthenticated attacks infeasible. Nevertheless, an accidental deadlock can interrupt critical network operations, leading to service outage and impacting availability. Prompt remediation is recommended to prevent potential downtime.