CVE-2026-97569: bnxt_en: Prevent queue stop with deferred completions
In the Linux kernel, the following vulnerability has been resolved:
bnxten: Prevent queue stop with deferred completions
When the driver receives a burst of packets, it can mark a BD with the NOCMPL bit to defer completions. The expectation is that the last packet in the ring will have this bit unset and the completion generated by that packet will cleanup that packet and the ones preceding it. This helps to reduce the number of completions fired.
The suppressed completions are controlled by the driver and the number of packets with suppressed completions scales with the size of the ring. SW USO packets, on the other hand, have an upper bound on the maximum number of BDs which can be consumed which does not scale with the ring size.
So, for small rings it is possible that: a burst of packets is handed to the driver, the driver defers completions for all of the packets because the number of free descriptors stays above the threshold in the driver. Then, a USO packet arrives, but the number of BDs available is not enough and the USO code exits early.
In this case, you end up in a state where the ring is full of packets with their completions suppressed, which can cause the queue to stop and never be restarted.
Assuming default CONFIGMAXSKBFRAGS, this is only possible for small rings (<= 457 descriptors, below the driver default value) when a burst of packets fills the ring, followed by a large USO packet that can't fit. For larger rings, the delta between the completion suppression threshold and the BDs required for SW USO is large enough that completions will fire and this case is unreachable.
This issue was pointed out by Sashiko and while it seems fairly unlikely given that the queue size must be small to trigger this, it is indeed possible.
Fix this by tracking the last BD which deferred completions and centralizing the logic for deciding when to ring the doorbell. The NOCMPL bit is now cleared in bnxttxrdbkick(), so every doorbell site is covered, including the SW USO early exit. This guarantees the ring always ends in a BD which generates a completion to clean it and wake the queue.
Affected Software
Event History
Frequently Asked Questions
Which systems are exposed to this condition?
Systems using the bnxt_en driver can encounter it when transmit completions are deferred. The described failure is possible with small descriptor rings, where a burst leaves all queued packets with suppressed completions and a subsequent software USO packet cannot obtain enough BDs.
What traffic sequence leads to the queue stopping?
A packet burst causes the driver to defer completions while free descriptors remain above its threshold. If a software USO packet then arrives when insufficient BDs are available, its processing exits early and no later completion remains to clean up the earlier deferred packets.