CVE-2026-99081 - Vulnerability Details

- bnxt_en: fix DMA mapping length for padded small packets

Description

In the Linux kernel, the following vulnerability has been resolved:

bnxt_en: fix DMA mapping length for padded small packets

Stefan Fleischmann reported Intel IOMMU DMA Read faults on BCM57412
NetXtreme-E NICs when transmitting packets on VLAN/macvlan interfaces:

DMAR: [DMA Read NO_PASID] Request device [18:00.0] fault addr 0xfc499000
[fault reason 0x06] PTE Read access is not set
bnxt_en 0000:18:00.0 eno1np0: Abandoning msg {0xb4 0x41a} len: 0 due to firmware status: 0x2000001
...
NETDEV WATCHDOG: eno1np0 (bnxt_en): transmit queue 0 timed out

The fault address (0xfc499000) is on an exact 4KB page boundary,
pointing to a DMA read buffer overrun.

In bnxt_start_xmit(), packets smaller than BNXT_MIN_PKT_SIZE (52 bytes),
such as 42-byte untagged ARP frames, are padded:

if (length < BNXT_MIN_PKT_SIZE) {
pad = BNXT_MIN_PKT_SIZE - length;
if (skb_pad(skb, pad))
goto tx_kick_pending;
length = BNXT_MIN_PKT_SIZE;
}

mapping = dma_map_single(&pdev->dev, skb->data, len, DMA_TO_DEVICE);
...
dma_unmap_len_set(tx_buf, len, len);

However, 'len' was initialized earlier to skb_headlen(skb) (e.g. 42 bytes)
and is left unadjusted after padding. Consequently, dma_map_single() and
dma_unmap_len_set() map and track only 42 bytes.

Later, the hardware TX buffer descriptor is programmed with the padded length:

txbd->tx_bd_len_flags_type =
cpu_to_le32(((len + pad) << TX_BD_LEN_SHIFT) | flags |
TX_BD_FLAGS_PACKET_END);

The NIC DMA engine is thus instructed to read 52 bytes from a region where
only 42 bytes were DMA-mapped. If skb->data ends near the boundary of a 4KB
page (within 'pad' bytes of the next page), the hardware DMA read overruns
into the unmapped adjacent page, triggering an IOMMU fault.

This issue was exposed after commit 447cbe95ebb9 ("vlan: fix skb_under_panic
and races when toggling HW VLAN offload") because reserving extra VLAN
headroom rounded LL_RESERVED_SPACE from 48 up to 64 bytes, shifting skb->data
offsets and potentially causing small frames to land right against page
boundaries.

Fix this by using skb_put_padto(skb, BNXT_MIN_PKT_SIZE) in
bnxt_start_xmit(), before skb_shinfo(skb)->nr_frags is sampled,
because padding might linearize the skb.
This ensures skb->len and skb_headlen(skb) reflect the padded size so
that dma_map_single() maps the full buffer and the descriptor length is
consistent. This also removes the temporary 'pad' variable and masking logic.

The padding is done after the SW USO branch, otherwise
bnxt_sw_udp_gso_xmit() would account the padding as UDP payload
and send it in extra segments.

Note that SW USO segments are still not padded: with IPv4, a segment
carrying less than 10 bytes of UDP payload (small gso_size, or a short
last segment) is sent as a frame shorter than BNXT_MIN_PKT_SIZE.
This is a separate issue, left for a followup patch.

Published: 2026-10-23

Score: 7.5 High

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The bnxt_en driver pads packets lower than 52 bytes to the minimum packet size but incorrectly maps only the original data length for DMA. When the padded packet crosses a 4 KB page boundary, the NIC DMA engine reads beyond the mapped region, causing an Intel IOMDMA DMA read fault. The driver watchdog logs a transmit queue timeout, halting packet transmission. No code‑execution pathway is provided by the fault; the effect is a loss of service for the affected NIC device.

Affected Systems

All Linux kernel installations that include the bnxt_en NetXtreme‑E NIC driver on Intel BCM57412 hardware. The bug exists in any kernel version that deploys the driver before the patch that replaces skb_pad with skb_put_padto and corrects the DMA mapping length.

Risk and Exploitability

The CVSS score of 7.5 marks medium‑high severity, while the EPSS score of <1% indicates a very low probability of exploitation in the wild. A local denial of service occurs via a kernel transmit timeout. The likely attack vector is network: an attacker with access to the host’s network interface could send small packets, such as ARP frames, that are padded and positioned near a 4 KB page boundary to trigger the fault. This inference is based on the description of the fault condition; the CVE specifies only that the fault occurs when the padded packet straddles a page boundary. The impact remains local to the host and does not allow remote code execution.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`c0c050c58d840994ba842ad1c338a98e7c12b764`	affected	< 0f347e00d060dc0bf3b2d0ee041206e54848c233
`c0c050c58d840994ba842ad1c338a98e7c12b764`	affected	< b3fd0177cf18a6ac98d41af80b4040010ea40f4d
`c0c050c58d840994ba842ad1c338a98e7c12b764`	affected	< 3a5d8465e73aff3c7d1ec38261dcaaa317367467
`c0c050c58d840994ba842ad1c338a98e7c12b764`	affected	< cf8530a25ae92c4493e2f22981ecb46f0b66f4c8
`c0c050c58d840994ba842ad1c338a98e7c12b764`	affected	< 2956aca14dd2977cd08bd2ccafae3beb8b84b268
`c0c050c58d840994ba842ad1c338a98e7c12b764`	affected	< fbd977e513971ccb4f0762a7f59eac500e474f89
`c0c050c58d840994ba842ad1c338a98e7c12b764`	affected	< 5213f65a9667d3dd85db2e6df8f2e0516290db34
`c0c050c58d840994ba842ad1c338a98e7c12b764`	affected	< a51d233ccd4889aadb71dace863525cc2b00271e

Linux

affected

Version	Status	Constraints
`4.4`	affected	—
`0`	unaffected	< 4.4
`5.10.273`	unaffected	≤ 5.10.*
`5.15.224`	unaffected	≤ 5.15.*
`6.1.191`	unaffected	≤ 6.1.*
`6.6.160`	unaffected	≤ 6.6.*
`6.12.113`	unaffected	≤ 6.12.*
`6.18.57`	unaffected	≤ 6.18.*
`7.2.11`	unaffected	≤ 7.2.*
`7.3`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

100%

Version	Status	Scheme	Platform
`[c0c050c58d840994ba842ad1c338a98e7c12b764,cf8530a25ae92c4493e2f22981ecb46f0b66f4c8)`	affected	code_commit	—
`[c0c050c58d840994ba842ad1c338a98e7c12b764,2956aca14dd2977cd08bd2ccafae3beb8b84b268)`	affected	code_commit	—
`[c0c050c58d840994ba842ad1c338a98e7c12b764,fbd977e513971ccb4f0762a7f59eac500e474f89)`	affected	code_commit	—
`[c0c050c58d840994ba842ad1c338a98e7c12b764,5213f65a9667d3dd85db2e6df8f2e0516290db34)`	affected	code_commit	—
`[c0c050c58d840994ba842ad1c338a98e7c12b764,a51d233ccd4889aadb71dace863525cc2b00271e)`	affected	code_commit	—

Linux

100%

Version	Status	Scheme	Platform
`4.4`	affected	generic	—
`[0,4.4)`	unaffected	generic	—
`[6.6.160,6.7.0)`	unaffected	semver	—
`[6.12.113,6.13.0)`	unaffected	semver	—
`[6.18.57,6.19.0)`	unaffected	semver	—
`[7.2.11,7.3.0)`	unaffected	semver	—
`[7.3,*]`	unaffected	generic	—

Linux

Linux Kernel

100%

Version	Status	Scheme	Platform
`[c0c050c58d840994ba842ad1c338a98e7c12b764,cf8530a25ae92c4493e2f22981ecb46f0b66f4c8)`	affected	code_commit	—
`[c0c050c58d840994ba842ad1c338a98e7c12b764,2956aca14dd2977cd08bd2ccafae3beb8b84b268)`	affected	code_commit	—
`[c0c050c58d840994ba842ad1c338a98e7c12b764,fbd977e513971ccb4f0762a7f59eac500e474f89)`	affected	code_commit	—
`[c0c050c58d840994ba842ad1c338a98e7c12b764,5213f65a9667d3dd85db2e6df8f2e0516290db34)`	affected	code_commit	—
`[c0c050c58d840994ba842ad1c338a98e7c12b764,a51d233ccd4889aadb71dace863525cc2b00271e)`	affected	code_commit	—

Linux

Linux Kernel

100%

Version	Status	Scheme	Platform
`4.4`	affected	generic	—
`[0,4.4)`	unaffected	generic	—
`[6.6.160,6.7.0)`	unaffected	semver	—
`[6.12.113,6.13.0)`	unaffected	semver	—
`[6.18.57,6.19.0)`	unaffected	semver	—
`[7.2.11,7.3.0)`	unaffected	semver	—
`[7.3,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Apply the kernel patch that replaces the incorrect skb_pad logic with skb_put_padto and corrects the DMA mapping length before the driver programs the buffer descriptor.
If a kernel upgrade is not immediately possible, disable VLAN/macvlan interfaces or otherwise eliminate small-packet traffic on the affected NIC to prevent the padded packet condition.
After applying the patch or disabling the interfaces, restart the networking stack and monitor system logs for any remaining IOMDMA fault events to confirm the issue is fully mitigated.

Generated by OpenCVE AI on October 27, 2026 at 10:32 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Ubuntu USN	USN-9018-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9018-2	Linux kernel (HWE) vulnerabilities
Ubuntu USN	USN-9019-1	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-9020-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9022-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9023-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9024-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9025-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9026-1	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-9039-1	Linux kernel (Azure CVM) vulnerabilities
Ubuntu USN	USN-9040-1	Linux kernel (Low Latency NVIDIA) vulnerabilities
Ubuntu USN	USN-9066-1	Linux kernel (HWE) vulnerabilities

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00518.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-99081.mbox
https://git.kernel.org/stable/c/0f347e00d060dc0bf3b2d0ee041206e54848c233
https://git.kernel.org/stable/c/2956aca14dd2977cd08bd2ccafae3beb8b84b268
https://git.kernel.org/stable/c/3a5d8465e73aff3c7d1ec38261dcaaa317367467
https://git.kernel.org/stable/c/5213f65a9667d3dd85db2e6df8f2e0516290db34
https://git.kernel.org/stable/c/a51d233ccd4889aadb71dace863525cc2b00271e
https://git.kernel.org/stable/c/b3fd0177cf18a6ac98d41af80b4040010ea40f4d
https://git.kernel.org/stable/c/cf8530a25ae92c4493e2f22981ecb46f0b66f4c8
https://git.kernel.org/stable/c/fbd977e513971ccb4f0762a7f59eac500e474f89
https://nvd.nist.gov/vuln/detail/CVE-2026-99081
https://www.cve.org/CVERecord?id=CVE-2026-99081

History

Fri, 30 Oct 2026 13:00:00 +0000

Type	Values Removed	Values Added
References		https://git.kernel.org/stable/c/0f347e00d060dc0bf3b2d0ee041206e54848c233 https://git.kernel.org/stable/c/3a5d8465e73aff3c7d1ec38261dcaaa317367467 https://git.kernel.org/stable/c/b3fd0177cf18a6ac98d41af80b4040010ea40f4d

Tue, 27 Oct 2026 04:30:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-125
References		https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-99081.mbox https://nvd.nist.gov/vuln/detail/CVE-2026-99081 https://www.cve.org/CVERecord?id=CVE-2026-99081
Metrics	threat_severity `None`	threat_severity `Moderate`

Sat, 24 Oct 2026 17:00:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-125

Sat, 24 Oct 2026 14:15:00 +0000

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}`

Fri, 23 Oct 2026 22:15:00 +0000

Type	Values Removed	Values Added
First Time appeared		Linux linux
Vendors & Products		Linux linux

Fri, 23 Oct 2026 17:00:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-125

Fri, 23 Oct 2026 12:45:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: bnxt_en: fix DMA mapping length for padded small packets Stefan Fleischmann reported Intel IOMMU DMA Read faults on BCM57412 NetXtreme-E NICs when transmitting packets on VLAN/macvlan interfaces: DMAR: [DMA Read NO_PASID] Request device [18:00.0] fault addr 0xfc499000 [fault reason 0x06] PTE Read access is not set bnxt_en 0000:18:00.0 eno1np0: Abandoning msg {0xb4 0x41a} len: 0 due to firmware status: 0x2000001 ... NETDEV WATCHDOG: eno1np0 (bnxt_en): transmit queue 0 timed out The fault address (0xfc499000) is on an exact 4KB page boundary, pointing to a DMA read buffer overrun. In bnxt_start_xmit(), packets smaller than BNXT_MIN_PKT_SIZE (52 bytes), such as 42-byte untagged ARP frames, are padded: if (length < BNXT_MIN_PKT_SIZE) { pad = BNXT_MIN_PKT_SIZE - length; if (skb_pad(skb, pad)) goto tx_kick_pending; length = BNXT_MIN_PKT_SIZE; } mapping = dma_map_single(&pdev->dev, skb->data, len, DMA_TO_DEVICE); ... dma_unmap_len_set(tx_buf, len, len); However, 'len' was initialized earlier to skb_headlen(skb) (e.g. 42 bytes) and is left unadjusted after padding. Consequently, dma_map_single() and dma_unmap_len_set() map and track only 42 bytes. Later, the hardware TX buffer descriptor is programmed with the padded length: txbd->tx_bd_len_flags_type = cpu_to_le32(((len + pad) << TX_BD_LEN_SHIFT) \| flags \| TX_BD_FLAGS_PACKET_END); The NIC DMA engine is thus instructed to read 52 bytes from a region where only 42 bytes were DMA-mapped. If skb->data ends near the boundary of a 4KB page (within 'pad' bytes of the next page), the hardware DMA read overruns into the unmapped adjacent page, triggering an IOMMU fault. This issue was exposed after commit 447cbe95ebb9 ("vlan: fix skb_under_panic and races when toggling HW VLAN offload") because reserving extra VLAN headroom rounded LL_RESERVED_SPACE from 48 up to 64 bytes, shifting skb->data offsets and potentially causing small frames to land right against page boundaries. Fix this by using skb_put_padto(skb, BNXT_MIN_PKT_SIZE) in bnxt_start_xmit(), before skb_shinfo(skb)->nr_frags is sampled, because padding might linearize the skb. This ensures skb->len and skb_headlen(skb) reflect the padded size so that dma_map_single() maps the full buffer and the descriptor length is consistent. This also removes the temporary 'pad' variable and masking logic. The padding is done after the SW USO branch, otherwise bnxt_sw_udp_gso_xmit() would account the padding as UDP payload and send it in extra segments. Note that SW USO segments are still not padded: with IPv4, a segment carrying less than 10 bytes of UDP payload (small gso_size, or a short last segment) is sent as a frame shorter than BNXT_MIN_PKT_SIZE. This is a separate issue, left for a followup patch.
Title		bnxt_en: fix DMA mapping length for padded small packets
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/2956aca14dd2977cd08bd2ccafae3beb8b84b268 https://git.kernel.org/stable/c/5213f65a9667d3dd85db2e6df8f2e0516290db34 https://git.kernel.org/stable/c/a51d233ccd4889aadb71dace863525cc2b00271e https://git.kernel.org/stable/c/cf8530a25ae92c4493e2f22981ecb46f0b66f4c8 https://git.kernel.org/stable/c/fbd977e513971ccb4f0762a7f59eac500e474f89

Subscriptions

Linux Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-10-23T12:23:28.347Z

Updated: 2026-10-30T12:41:36.421Z

Reserved: 2026-09-25T10:25:14.390Z

Link: CVE-2026-99081

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-10-23T13:17:32.293

Modified: 2026-10-30T13:21:44.050

Link: CVE-2026-99081

Redhat

Severity : Moderate

Publid Date: 2026-10-23T00:00:00Z

Links: CVE-2026-99081 - Bugzilla

OpenCVE Enrichment

Updated: 2026-10-27T10:45:06Z

Weaknesses

CWE-125
Out-of-bounds Read

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object