The Linux kernel driver bnxt_en fails to propagate an allocation failure when setting up hardware TPA buffers. The routine bnxt_alloc_one_tpa_info_data() returns an error, but that return value is ignored, leaving the ring partially initialized. The hardware may then select an uninitialized buffer slot that contains a zero DMA address, causing the device to encounter an invalid memory reference and potentially crash. The problem is restricted to local kernel operations on systems running affected versions of the bnxt_en driver, and does not directly provide code execution or information disclosure.

The vulnerability is present in any Linux installation that contains the bnxt_en network driver, with no specific kernel version range listed. All builds before the fixed commit are considered affected until the patch is applied.

The CVSS score of 5.5 indicates a medium severity, while the EPSS score of < 1% suggests a low likelihood of exploitation in the near term. The vulnerability is not listed in the CISA KEV catalog, meaning no known public exploit is documented. The attacker must have local kernel privileges or be able to trigger a buffer allocation failure within the driver. When bnxt_alloc_one_tpa_info_data() fails and the failure is not propagated, the driver may install a partially initialized ring that can hand a zero DMA address to the hardware. This zero DMA address can trigger a device fault, leading the network stack or driver to crash or become unresponsive, resulting in a local denial‑of‑service for network services. The attack vector is inferred to be local kernel exploitation, i.e., the attacker manipulates memory allocation flows in the driver.