The bnxt_en network driver can defer packet completions by setting a NO_CMPL bit on buffer descriptors. When a burst of packets is processed, the driver may mark all descriptors as deferred, leaving no completion pending. If the driver’s transmit ring is small (up to 457 descriptors) and a large user‑space offload (SW USO) packet follows, the driver cannot free enough descriptors and exits early. The ring then remains full of descriptors with suppressed completions, preventing any completion message and causing the transmit queue to stall permanently. The update resolves the issue by clearing the NO_CMPL flag in every doorbell path, ensuring that at least one completion is generated to clean the queue.

This issue exists only in the Linux kernel’s bnxt_en driver. Systems running a kernel featuring the vulnerable driver and configured with a small transmit ring (default maximum 457 descriptors) are affected. The problem is confined to this driver; other network drivers or user‑space applications are not impacted.

The CVSS score of 5.5 indicates moderate severity, and the EPSS score of < 1% reflects a very low likelihood of exploitation. The driver is not listed in CISA’s KEV catalog. Exploitation would require a specific traffic pattern – a burst of packets followed by a large SW USO packet – and is therefore unlikely to occur accidentally. If an attacker can control the traffic to an interface with a small transmit ring, they could induce a permanent queue stall. No public exploit has been reported, and the impact is limited to denial of service on the affected network interface.