The bnxt_en driver miscalculates a software TPA (Transmit Packet Adapter) identifier from firmware values. When the firmware advertises fewer TPAs than the kernel expects, the driver can compute an index that exceeds the allocated array bounds. Accessing rx_tpa[agg_id] with an out‑of‑range value results in an OOPS and a kernel panic during packet reception. The crash is immediate at boot or when traffic is processed, and can be triggered by sending packets to the vulnerable interface. The vulnerability does not provide direct information disclosure or code execution beyond the kernel crash, but it causes a denial of service by halting the system. Based on the description, it is inferred that any entity capable of influencing packet reception—such as a remote attacker sending crafted traffic to the affected NIC—can trigger the crash. The attack vector therefore can be remote via network access, though a local administrator or a system reboot also triggers the bug. The impact is thus a system-wide service interruption and loss of availability, qualifying as a high‑severity denial of service.

Affected systems include any Linux kernel running the bnxt_en Ethernet driver with firmware that advertises fewer concurrent TPAs than the driver allows. The known trigger involves a 57608 NIC with firmware 233 that advertises 32 concurrent TPAs. More generally, any kernel version prior to the commit that bounds SW TPA IDs and any hardware component that relies on the bnxt_en driver are potentially vulnerable. The bug is specific to the bnxt_en module; other kernel subsystems are not impacted.

The CVSS score is not published, but the kernel panic result indicates a high impact, effectively allowing an attacker to cause a denial of service. The EPSS score is not available, so the current exploit probability is unknown. The vulnerability is not listed in the CISA KEV catalog, implying no confirmed exploited cases. If an attacker can trigger packet reception on the vulnerable interface—by remotely sending specially crafted traffic or by manipulating the NIC firmware—the kernel will crash. Thus the risk is significant for exposed systems and warrants prompt remediation.