CVE-2026-74697: bnxt_en: Disable EOP for TPA on all chips to prevent data corruption
In the Linux kernel, the following vulnerability has been resolved:
bnxten: Disable EOP for TPA on all chips to prevent data corruption
EOP (End of frame padding) on the AGG ring may cause overlapping of zero padding at the end of one segment with the next segment's data. If Relaxed Ordering (RO) is enabled, the zero padding may overwrite valid data in the next segment and corrupt the data. Older chips (P5 and older) do not automatically disable RO when EOP is enabled. On some ARM systems, data corruption was reported on 57508 (P5) chips with RO enabled.
Always disable EOP on all chips on the AGG rings when TPA is enabled to fix the data corruption.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
bnxt_ento a version that resolves this vulnerability.Patch 57508 - Configuration
Disable EOP on all chips on the AGG rings when TPA is enabled to prevent data corruption. For older chips (e.g., 57508 / P5 and older) do not automatically disable RO when EOP is enabled; keep RO behavior but ensure EOP is disabled for TPA on all chips with RO enabled.
bnxt_en EOP (End of frame padding) = disabled
Event History
Frequently Asked Questions
Which systems are most likely to experience corruption?
Systems using the bnxt_en driver with TPA enabled and Relaxed Ordering enabled are exposed to this corruption condition. The issue is specifically reported on some ARM systems using 57508 (P5) chips, and P5 and older chips do not automatically disable Relaxed Ordering when EOP is enabled.
What configuration is required for the problem to occur?
The condition involves EOP enabled on AGG rings while TPA and Relaxed Ordering are enabled. Under those conditions, zero padding at the end of one segment can overlap and overwrite valid data in the next segment.
What mitigation is described if an update cannot be applied immediately?
Disable EOP on AGG rings when TPA is enabled. This prevents the overlapping zero padding that can corrupt subsequent segment data.