CVE-2026-97571: bnxt_en: Propagate TPA buffer allocation failures in bnxt_queue_mem_alloc()

Published Sep 25, 2026
·
Updated

In the Linux kernel, the following vulnerability has been resolved:

bnxten: Propagate TPA buffer allocation failures in bnxtqueuememalloc()

bnxtalloconetpainfodata() returns -ENOMEM as soon as one allocation fails. This leaves the remaining rxr->rxtpa[] entries zeroed.

bnxtqueuememalloc() discards that return value, so the partially initialized ring is installed by bnxtqueuestart().

Since the aggid is picked by the hardware and bnxtallocaggidx maps it to a SW index in rxr->rxtpa[], it is possible that an uninitialized slot can be chosen which would hand a zero DMA address to the device.

Fix this by checking the return value of bnxtalloconetpainfodata and unwinding, freeing the ring buffers.

Affected Software

1 affected component
Linux Linux kernel

Remediation

Recommended actions to resolve this vulnerability, in priority order.

  1. Compensating control

    Update bnxt_queue_mem_alloc() to check and propagate the return value of bnxt_alloc_one_tpa_info_data(); on allocation failure, unwind and free the ring buffers so a partially initialized ring is not installed by bnxt_queue_start().

Event History

Sep 25, 2026
CVE Published
via MITRE·10:21 AM
Data Sourced
via MITRE·10:21 AM
Description
Data Sourced
via NVD·11:17 AM
Description

Frequently Asked Questions

1

What conditions are required for this issue to occur?

A TPA buffer allocation must fail during bnxt_queue_mem_alloc(), leaving some rxr->rx_tpa[] entries uninitialized. The affected code then installs the partially initialized receive ring, and hardware must select an aggregation ID that maps to one of those uninitialized entries.

2

What is the potential impact of the partially initialized ring?

An uninitialized rxr->rx_tpa[] slot can result in a zero DMA address being handed to the device. The supplied information does not state a specific attacker capability or resulting security impact beyond this invalid device DMA address condition.

3

How does the fix address the problem?

The fix checks the return value from bnxt_alloc_one_tpa_info_data(). If allocation fails, it unwinds the setup and frees the ring buffers instead of starting a queue with a partially initialized ring.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203