CVE-2026-97570: bnxt_en: Bound SW TPA IDs to prevent crashes

Published Sep 25, 2026
·
Updated

In the Linux kernel, the following vulnerability has been resolved:

bnxten: Bound SW TPA IDs to prevent crashes

FW supports up to 1024 concurrent TPAs, so the FW TPA ID is in the range 0..1023 (see commit ec4d8e7cf024 ("bnxten: Add TPA ID mapping logic for 57500 chips.")). bnxtallocaggidx is intended to wrap the FW ID down to a software ID which is used to index rxr->rxtpa, and to generate a mapping between FW IDs and the wrapped software ID.

On a 57608 with firmware version 233, the firmware advertises 32 concurrent TPAs. As of the commit under fixes, bp->maxtpa on this NIC is set to 32.

If the software ID from bnxtallocaggidx is above 31, this results in an invalid address being loaded on this line:

tpainfo = &rxr->rxtpa[aggid];

because rxtpa is allocated with only bp->maxtpa (32) entries. Writes to tpainfo later in the code are out of bounds.

This bug results in a crash at boot:

Oops: general protection fault, kernel NULL pointer dereference 0x8: 0000 [#1] SMP NOPTI RIP: 0010:bnxtrxpkt+0xc0/0x1560 RSP: 0018:ffffc900009b8c78 EFLAGS: 00010246 RAX: 0000000000000000 RBX: 0000000000000048 RCX: 0000000206682516 RDX: ffffc900009b8db4 RSI: 0000000000000000 RDI: 01ffffff038fe1c0 RBP: ffffc9006e687480 R08: ffffc9006e687000 R09: 0000000000003048 R10: 0000000000000480 R11: ffff8881c6083900 R12: 0000000006682516 R13: ffff8881c6095400 R14: 0000000000000016 R15: ffff8881c6b66680 FS: 0000000000000000(0000) GS:ffff88fef3c77000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007fc8bda40584 CR3: 000000807c812001 CR4: 0000000008772ef0 PKRU: 55555554 Call Trace: <IRQ> ? netifreceiveskblistcore+0x1ca/0x250 bnxtpollwork+0x152/0x280 bnxtpollp5+0x1cd/0x480 napipoll+0x30/0x180 netrxaction+0x20b/0x3b0 ? notegpchanges+0x53/0xe0 ? ticksetupschedtimer+0x180/0x180 ? napischedule+0x9a/0xb0 ? bnxtmsix+0x24/0x30 handlesoftirqs+0xdd/0x2c0 irqexitrcu.llvm.3171231171502365008+0x47/0xf0 commoninterrupt+0x85/0x90 </IRQ> <TASK> asmcommoninterrupt+0x22/0x40

This stack trace is from a crash triggered when an out of bounds rxtpa is dereferenced. The invalid write mentioned above is silent in this particular crash.

Fix this by allocating rxtpa with bp->maxtpa rounded up to the next power of 2 (bp->maxtparoundupsize) entries and masking the FW TPA ID with that size, so the wrapped ID can never index past the end of the array.

Affected Software

1 affected component
Linux Linux kernel

Remediation

Recommended actions to resolve this vulnerability, in priority order.

  1. Upgrade

    Upgrade to a fixed release to a version that resolves this vulnerability.

    Patch ec4d8e7cf024

Event History

Sep 25, 2026
CVE Published
via MITRE·10:21 AM
Data Sourced
via MITRE·10:21 AM
DescriptionSeverity
Data Sourced
via NVD·11:17 AM
DescriptionSeverity

Frequently Asked Questions

1

Which systems are known to be affected by the reported crash condition?

The issue was observed on a 57608 NIC running firmware version 233, where the firmware advertises 32 concurrent TPAs and the driver allocates 32 rx_tpa entries. Systems using the bnxt_en driver with firmware TPA IDs that are mapped to software IDs above the allocated limit are at risk.

2

How can I tell whether this issue is occurring on a host?

The reported symptom is a boot-time kernel crash in bnxt_rx_pkt, including a general protection fault and kernel NULL pointer dereference. The underlying condition is an out-of-bounds access to rxr->rx_tpa when the mapped aggregation ID exceeds the available entries.

3

What is the operational impact of the flaw?

An invalid software TPA ID can cause out-of-bounds writes to the rx_tpa array. In the reported case, this causes the Linux kernel to crash during boot.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203