The bnxt_en network driver in the Linux kernel contains a flaw in its ring reset logic. When bnxt_rx_ring_reset() frees existing ring buffers and attempts to allocate new ones, an allocation failure inside bnxt_alloc_one_tpa_info_data() is ignored and the reset loop continues. The driver then re-enables TPA offload with an incompletely initialized rx_tpa array, which results in a zero DMA address being programmed into the NIC firmware. The hardware attempts to read this address, causing a fault that crashes the kernel. The vulnerability arises from unchecked allocation failures and improper error handling.

The issue exists in any Linux kernel that includes the bnxt_en driver prior to the upstream patch. Because no specific kernel version range is listed, any release before the fix commit is considered vulnerable and requires a kernel update.

The base CVSS score of 8.1 indicates high severity. The EPSS score is less than 1% and the vulnerability is not listed in CISA’s KEV catalog, implying no publicly known exploits at present. Based on the driver reset routine, it is inferred that triggering the reset path may require privileged local access. Once activated it can crash the kernel or disrupt network services, delivering a denial of service. The overall risk is moderate to high for systems running unpatched kernels, while the likelihood of exploitation remains low until an attacker gains local privileges or another vulnerability is leveraged to invoke the reset routine.