CVE-2026-97572

bnxt_en: Propagate RX ring init failures in bnxt_init_nic()

Published Sep 25, 2026 CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Description

In the Linux kernel, the following vulnerability has been resolved:

bnxt_en: Propagate RX ring init failures in bnxt_init_nic()

bnxt_init_rx_rings() returns an error when bnxt_alloc_one_rx_ring()
fails, but bnxt_init_nic() discards that return value and calls
bnxt_init_chip(), which enables TPA.

If an allocation fails, this could leave rxr->rx_tpa[] partially zeroed
and TPA would be enabled over an array with zeroed entries. This would
lead to a zeroed DMA address being handed out if the agg_idx is
translated to a SW index at a zeroed entry.

Fix this by propagating the error out of bnxt_init_nic(). Both callers
already check its return value and unwind with bnxt_free_skbs() and
bnxt_free_mem(), which tolerate a partially initialized RX ring.

Analysis

Technical impact

The bnxt_en network driver in the Linux kernel contains an error‑handling flaw: when bnxt_alloc_one_rx_ring() fails, its error return is ignored by bnxt_init_nic(), which then enables Transparent Packet Acceleration (TPA) using partially zeroed rx_tpa[] entries. This can result in a zeroed DMA address being used for packet aggregation, leading to driver crashes or loss of network interface functionality. No direct data confidentiality or integrity impact is cited, but the instability manifests as a denial of service to network traffic.

Affected Systems

The flaw is present in the Linux kernel's bnxt_en driver and affects all Linux distributions that ship with a kernel version prior to the patch. Every vendor that includes this driver in its standard kernel build is potentially exposed until the update is applied.

Risk and Exploitability

The CVSS score of 5.5 and the EPSS score of <1% indicate moderate severity and low likelihood of exploitation. The vulnerability is not listed in CISA's KEV catalog. No evidence of remote exploitation is provided. Based on the description, it is inferred that an attacker can trigger the failure by causing the driver to allocate uninitialized rings, a local action such as restarting the bnxt_en driver or rebooting the system, leading to a denial of service. The overall risk remains moderate.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`c0c050c58d840994ba842ad1c338a98e7c12b764`	affected	< e40641638743b4b848d5ed78a0565afffc359d8e
`c0c050c58d840994ba842ad1c338a98e7c12b764`	affected	< 6b24eca42619b93f69aebc2aa0a9fd28ac9a5085
`c0c050c58d840994ba842ad1c338a98e7c12b764`	affected	< 1f2d333ae2e1a73b7cc1c2a627587024cd147c01
`c0c050c58d840994ba842ad1c338a98e7c12b764`	affected	< c3eb07e78e628243cbb9bbb0115db802fb7a303f
`c0c050c58d840994ba842ad1c338a98e7c12b764`	affected	< daadccd062fdca5e77a8cc22ffe35857803b6c49
`c0c050c58d840994ba842ad1c338a98e7c12b764`	affected	< b4c40f2c80d7bf50648878bc206a39adfbfaec6c
`c0c050c58d840994ba842ad1c338a98e7c12b764`	affected	< dfd73af81cdb9f7b399754a59e2658a08211bee5
`c0c050c58d840994ba842ad1c338a98e7c12b764`	affected	< 8e6a850c0746bb4be167aedf1ee57469fcda09a9

Linux

affected

Version	Status	Constraints
`4.4`	affected	—
`0`	unaffected	< 4.4
`5.10.271`	unaffected	≤ 5.10.*
`5.15.222`	unaffected	≤ 5.15.*
`6.1.189`	unaffected	≤ 6.1.*
`6.6.158`	unaffected	≤ 6.6.*
`6.12.111`	unaffected	≤ 6.12.*
`6.18.53`	unaffected	≤ 6.18.*
`7.2.7`	unaffected	≤ 7.2.*
`7.3`	unaffected	≤ *

No data.

Vendor Product Versions

Linux

Linux Kernel

Version	Status	Scheme	Platform
`[c0c050c58d840994ba842ad1c338a98e7c12b764,daadccd062fdca5e77a8cc22ffe35857803b6c49)`	affected	code_commit	—
`[c0c050c58d840994ba842ad1c338a98e7c12b764,b4c40f2c80d7bf50648878bc206a39adfbfaec6c)`	affected	code_commit	—
`[c0c050c58d840994ba842ad1c338a98e7c12b764,dfd73af81cdb9f7b399754a59e2658a08211bee5)`	affected	code_commit	—
`[c0c050c58d840994ba842ad1c338a98e7c12b764,8e6a850c0746bb4be167aedf1ee57469fcda09a9)`	affected	code_commit	—

Linux

Linux Kernel

Version	Status	Scheme	Platform
`4.4`	affected	semver	—
`[0,4.4)`	unaffected	semver	—
`[6.12.111,6.13.0)`	unaffected	semver	—
`[6.18.53,6.19.0)`	unaffected	semver	—
`[7.2.7,7.3.0)`	unaffected	semver	—
`[7.3-rc3,*]`	unaffected	generic	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade the kernel to the latest release that contains the bnxt_en driver fix and reboot the system to load the corrected module.
If a kernel upgrade cannot be performed immediately, apply the upstream patch by replacing the bnxt_en module with the source that propagates allocation errors and reload the driver.
Continuously monitor kernel logs (e.g., dmesg) and network connectivity to confirm that the driver initializes without errors and that network traffic resumes normal operation.

Generated by OpenCVE AI on October 1, 2026 at 11:22 UTC.

Tracking

Advisories

Source	ID	Title
Debian DLA	DLA-4817-1	linux-6.12 security update
Debian DLA	DLA-4841-1	linux security update
Debian DSA	DSA-6528-1	linux security update
Ubuntu USN	USN-8961-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9019-1	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-9020-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9022-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9023-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9024-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9025-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9026-1	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-9029-1	Linux kernel (Raspberry Pi) vulnerabilities
Ubuntu USN	USN-9039-1	Linux kernel (Azure CVM) vulnerabilities
Ubuntu USN	USN-9040-1	Linux kernel (Low Latency NVIDIA) vulnerabilities
Ubuntu USN	USN-9066-1	Linux kernel (HWE) vulnerabilities
Ubuntu USN	USN-9091-1	Linux kernel (NVIDIA Tegra) vulnerabilities

Metrics

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.216% probability within 30 days)

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-97572.mbox
https://git.kernel.org/stable/c/1f2d333ae2e1a73b7cc1c2a627587024cd147c01
https://git.kernel.org/stable/c/6b24eca42619b93f69aebc2aa0a9fd28ac9a5085
https://git.kernel.org/stable/c/8e6a850c0746bb4be167aedf1ee57469fcda09a9
https://git.kernel.org/stable/c/b4c40f2c80d7bf50648878bc206a39adfbfaec6c
https://git.kernel.org/stable/c/c3eb07e78e628243cbb9bbb0115db802fb7a303f
https://git.kernel.org/stable/c/daadccd062fdca5e77a8cc22ffe35857803b6c49
https://git.kernel.org/stable/c/dfd73af81cdb9f7b399754a59e2658a08211bee5
https://git.kernel.org/stable/c/e40641638743b4b848d5ed78a0565afffc359d8e
https://nvd.nist.gov/vuln/detail/CVE-2026-97572
https://www.cve.org/CVERecord?id=CVE-2026-97572

History

Oct 3, 2026 11:15 AM Added references View changes

Type	Values Removed	Values Added
References		https://git.kernel.org/stable/c/1f2d333ae2e1a73b7cc1c2a627587024cd147c01 https://git.kernel.org/stable/c/6b24eca42619b93f69aebc2aa0a9fd28ac9a5085 https://git.kernel.org/stable/c/c3eb07e78e628243cbb9bbb0115db802fb7a303f https://git.kernel.org/stable/c/e40641638743b4b848d5ed78a0565afffc359d8e

Sep 29, 2026 1:15 PM Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-252
References		https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-97572.mbox https://nvd.nist.gov/vuln/detail/CVE-2026-97572 https://www.cve.org/CVERecord?id=CVE-2026-97572
Metrics	threat_severity `None`	cvssV3_1 `{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Moderate`

Sep 25, 2026 10:30 AM Description updated. Title updated. First appearance in the feed. Affected versions updated. Affected vendors updated. Added references View changes

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: bnxt_en: Propagate RX ring init failures in bnxt_init_nic() bnxt_init_rx_rings() returns an error when bnxt_alloc_one_rx_ring() fails, but bnxt_init_nic() discards that return value and calls bnxt_init_chip(), which enables TPA. If an allocation fails, this could leave rxr->rx_tpa[] partially zeroed and TPA would be enabled over an array with zeroed entries. This would lead to a zeroed DMA address being handed out if the agg_idx is translated to a SW index at a zeroed entry. Fix this by propagating the error out of bnxt_init_nic(). Both callers already check its return value and unwind with bnxt_free_skbs() and bnxt_free_mem(), which tolerate a partially initialized RX ring.
Title		bnxt_en: Propagate RX ring init failures in bnxt_init_nic()
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/8e6a850c0746bb4be167aedf1ee57469fcda09a9 https://git.kernel.org/stable/c/b4c40f2c80d7bf50648878bc206a39adfbfaec6c https://git.kernel.org/stable/c/daadccd062fdca5e77a8cc22ffe35857803b6c49 https://git.kernel.org/stable/c/dfd73af81cdb9f7b399754a59e2658a08211bee5