CVE-2026-97570: bnxt_en: Bound SW TPA IDs to prevent crashes
In the Linux kernel, the following vulnerability has been resolved:
bnxten: Bound SW TPA IDs to prevent crashes
FW supports up to 1024 concurrent TPAs, so the FW TPA ID is in the range 0..1023 (see commit ec4d8e7cf024 ("bnxten: Add TPA ID mapping logic for 57500 chips.")). bnxtallocaggidx is intended to wrap the FW ID down to a software ID which is used to index rxr->rxtpa, and to generate a mapping between FW IDs and the wrapped software ID.
On a 57608 with firmware version 233, the firmware advertises 32 concurrent TPAs. As of the commit under fixes, bp->maxtpa on this NIC is set to 32.
If the software ID from bnxtallocaggidx is above 31, this results in an invalid address being loaded on this line:
tpainfo = &rxr->rxtpa[aggid];
because rxtpa is allocated with only bp->maxtpa (32) entries. Writes to tpainfo later in the code are out of bounds.
This bug results in a crash at boot:
Oops: general protection fault, kernel NULL pointer dereference 0x8: 0000 [#1] SMP NOPTI RIP: 0010:bnxtrxpkt+0xc0/0x1560 RSP: 0018:ffffc900009b8c78 EFLAGS: 00010246 RAX: 0000000000000000 RBX: 0000000000000048 RCX: 0000000206682516 RDX: ffffc900009b8db4 RSI: 0000000000000000 RDI: 01ffffff038fe1c0 RBP: ffffc9006e687480 R08: ffffc9006e687000 R09: 0000000000003048 R10: 0000000000000480 R11: ffff8881c6083900 R12: 0000000006682516 R13: ffff8881c6095400 R14: 0000000000000016 R15: ffff8881c6b66680 FS: 0000000000000000(0000) GS:ffff88fef3c77000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007fc8bda40584 CR3: 000000807c812001 CR4: 0000000008772ef0 PKRU: 55555554 Call Trace: <IRQ> ? netifreceiveskblistcore+0x1ca/0x250 bnxtpollwork+0x152/0x280 bnxtpollp5+0x1cd/0x480 napipoll+0x30/0x180 netrxaction+0x20b/0x3b0 ? notegpchanges+0x53/0xe0 ? ticksetupschedtimer+0x180/0x180 ? napischedule+0x9a/0xb0 ? bnxtmsix+0x24/0x30 handlesoftirqs+0xdd/0x2c0 irqexitrcu.llvm.3171231171502365008+0x47/0xf0 commoninterrupt+0x85/0x90 </IRQ> <TASK> asmcommoninterrupt+0x22/0x40
This stack trace is from a crash triggered when an out of bounds rxtpa is dereferenced. The invalid write mentioned above is silent in this particular crash.
Fix this by allocating rxtpa with bp->maxtpa rounded up to the next power of 2 (bp->maxtparoundupsize) entries and masking the FW TPA ID with that size, so the wrapped ID can never index past the end of the array.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch ec4d8e7cf024
Event History
Frequently Asked Questions
Which systems are known to be affected by the reported crash condition?
The issue was observed on a 57608 NIC running firmware version 233, where the firmware advertises 32 concurrent TPAs and the driver allocates 32 rx_tpa entries. Systems using the bnxt_en driver with firmware TPA IDs that are mapped to software IDs above the allocated limit are at risk.
How can I tell whether this issue is occurring on a host?
The reported symptom is a boot-time kernel crash in bnxt_rx_pkt, including a general protection fault and kernel NULL pointer dereference. The underlying condition is an out-of-bounds access to rxr->rx_tpa when the mapped aggregation ID exceeds the available entries.
What is the operational impact of the flaw?
An invalid software TPA ID can cause out-of-bounds writes to the rx_tpa array. In the reported case, this causes the Linux kernel to crash during boot.