CVE-2026-97569: bnxt_en: Prevent queue stop with deferred completions

Published Sep 25, 2026
·
Updated

In the Linux kernel, the following vulnerability has been resolved:

bnxten: Prevent queue stop with deferred completions

When the driver receives a burst of packets, it can mark a BD with the NOCMPL bit to defer completions. The expectation is that the last packet in the ring will have this bit unset and the completion generated by that packet will cleanup that packet and the ones preceding it. This helps to reduce the number of completions fired.

The suppressed completions are controlled by the driver and the number of packets with suppressed completions scales with the size of the ring. SW USO packets, on the other hand, have an upper bound on the maximum number of BDs which can be consumed which does not scale with the ring size.

So, for small rings it is possible that: a burst of packets is handed to the driver, the driver defers completions for all of the packets because the number of free descriptors stays above the threshold in the driver. Then, a USO packet arrives, but the number of BDs available is not enough and the USO code exits early.

In this case, you end up in a state where the ring is full of packets with their completions suppressed, which can cause the queue to stop and never be restarted.

Assuming default CONFIGMAXSKBFRAGS, this is only possible for small rings (<= 457 descriptors, below the driver default value) when a burst of packets fills the ring, followed by a large USO packet that can't fit. For larger rings, the delta between the completion suppression threshold and the BDs required for SW USO is large enough that completions will fire and this case is unreachable.

This issue was pointed out by Sashiko and while it seems fairly unlikely given that the queue size must be small to trigger this, it is indeed possible.

Fix this by tracking the last BD which deferred completions and centralizing the logic for deciding when to ring the doorbell. The NOCMPL bit is now cleared in bnxttxrdbkick(), so every doorbell site is covered, including the SW USO early exit. This guarantees the ring always ends in a BD which generates a completion to clean it and wake the queue.

Affected Software

1 affected component
Linux Linux kernel

Event History

Sep 25, 2026
CVE Published
via MITRE·10:21 AM
Data Sourced
via MITRE·10:21 AM
Description
Data Sourced
via NVD·11:17 AM
Description

Frequently Asked Questions

1

Which systems are exposed to this condition?

Systems using the bnxt_en driver can encounter it when transmit completions are deferred. The described failure is possible with small descriptor rings, where a burst leaves all queued packets with suppressed completions and a subsequent software USO packet cannot obtain enough BDs.

2

What traffic sequence leads to the queue stopping?

A packet burst causes the driver to defer completions while free descriptors remain above its threshold. If a software USO packet then arrives when insufficient BDs are available, its processing exits early and no later completion remains to clean up the earlier deferred packets.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203