Description
In the Linux kernel, the following vulnerability has been resolved:

net: bnxt: ring the doorbell when SW USO exits early

When a burst of packets is handed down to the driver, the driver defers
the doorbell to the end by setting txr->kick_pending = 1. The normal TX
path handles this, but the SW USO path can miss it if it returns
early.

If bnxt_sw_udp_gso_xmit runs but returns early with NETDEV_TX_BUSY and
txr->kick_pending was previously set to 1, then the TX queue can
stall because the driver wrote some BDs but never wrote the doorbell.
The device won't know to do the TX which would generate the completion
that would wake the queue back up.

Simplify bnxt_sw_udp_gso_xmit to set txr->kick_pending in its success
case and check the flag on return. The added check after
bnxt_sw_udp_gso_xmit returns ensures that any pending doorbells are
written handling both successful USO and any early returns, which
prevents the TX queue stall mentioned above.

This TX queue stall was observed on a production system with a netdev TX
watchdog informing about the queue stall.
Published: 2026-09-11
Score: 7.5 High
EPSS: < 1% Very Low
KEV: No
Impact: Denial of Service via TX queue stall
Action: Patch Now
AI Analysis

Impact

The bnxt driver’s handling of software UDP GSO can leave a transmit queue permanently stalled when the driver returns early with the NETDEV_TX_BUSY status while a doorbell had been scheduled. Because the system never rings the hardware doorbell, the network device never completes the pending transmit descriptors, and the kernel’s TX watchdog reports a stalled queue. This results in loss of outbound traffic and effectively a denial of service for the affected network interface.

Affected Systems

All Linux kernel builds using the bnxt device driver are susceptible. The flaw does not reference a specific kernel version, so any system running a kernel that includes the bnxt driver before the described patch is at risk.

Risk and Exploitability

The CVSS score is 5.9, indicating a moderate severity. EPSS is not available, and the vulnerability is not listed in the CISA KEV catalog. Inferred attack vectors include an attacker sending specially crafted bursts of UDP GSO packets to the vulnerable machine, which would trigger the early return path and stall the TX queue. No public exploits have been reported, but the conditions for exploitation – excessive packet burst and driver engagement – are achievable remotely via the network stack.

Generated by OpenCVE AI on September 12, 2026 at 01:53 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the latest kernel update that incorporates the bnxt_sw_udp_gso_xmit patch or backport the specific commit fixing txr->kick_pending handling.
  • If an immediate kernel upgrade is not feasible, consider disabling software UDP GSO for the bnxt device by setting relevant driver parameters or sysctl values that reduce or eliminate GSO usage.
  • After applying a fix or disabling the feature, monitor kernel logs for "TX watchdog" or bnxt-specific stall messages and restart the networking stack if a stall is detected to restore normal operation.

Generated by OpenCVE AI on September 12, 2026 at 01:53 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sun, 13 Sep 2026 06:45:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 5.9, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H'}

 cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}

Sat, 12 Sep 2026 00:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-841
References
Metrics threat_severity

None

 cvssV3_1

{'score': 5.9, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H'}

threat_severity

Moderate

Fri, 11 Sep 2026 23:45:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: net: bnxt: ring the doorbell when SW USO exits early When a burst of packets is handed down to the driver, the driver defers the doorbell to the end by setting txr->kick_pending = 1. The normal TX path handles this, but the SW USO path can miss it if it returns early. If bnxt_sw_udp_gso_xmit runs but returns early with NETDEV_TX_BUSY and txr->kick_pending was previously set to 1, then the TX queue can stall because the driver wrote some BDs but never wrote the doorbell. The device won't know to do the TX which would generate the completion that would wake the queue back up. Simplify bnxt_sw_udp_gso_xmit to set txr->kick_pending in its success case and check the flag on return. The added check after bnxt_sw_udp_gso_xmit returns ensures that any pending doorbells are written handling both successful USO and any early returns, which prevents the TX queue stall mentioned above. This TX queue stall was observed on a production system with a netdev TX watchdog informing about the queue stall.
Title net: bnxt: ring the doorbell when SW USO exits early
First Time appeared Linux
Linux linux Kernel
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel
References

Subscriptions

Linux Linux Kernel
cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published:

Updated: 2026-09-13T06:29:01.300Z

Reserved: 2026-08-26T14:34:25.812Z

Link: CVE-2026-80998

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-09-11T20:19:06.873

Modified: 2026-09-13T07:17:06.483

Link: CVE-2026-80998

cve-icon Redhat

Severity : Moderate

Publid Date: 2026-09-11T19:42:52Z

Links: CVE-2026-80998 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-09-12T09:45:11Z

Weaknesses
  • CWE-841

    Improper Enforcement of Behavioral Workflow