CVE-2026-97571: bnxt_en: Propagate TPA buffer allocation failures in bnxt_queue_mem_alloc()
In the Linux kernel, the following vulnerability has been resolved:
bnxten: Propagate TPA buffer allocation failures in bnxtqueuememalloc()
bnxtalloconetpainfodata() returns -ENOMEM as soon as one allocation fails. This leaves the remaining rxr->rxtpa[] entries zeroed.
bnxtqueuememalloc() discards that return value, so the partially initialized ring is installed by bnxtqueuestart().
Since the aggid is picked by the hardware and bnxtallocaggidx maps it to a SW index in rxr->rxtpa[], it is possible that an uninitialized slot can be chosen which would hand a zero DMA address to the device.
Fix this by checking the return value of bnxtalloconetpainfodata and unwinding, freeing the ring buffers.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.12.112 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.18.53 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.115-2Fixed in 7.2.12-1Fixed in 7.2.15-1 - Upgrade
Upgrade
debian/linux-6.12to a version that resolves this vulnerability.Fixed in 6.12.113-1~deb12u1 - Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Compensating control
In bnxt_queue_mem_alloc(), check and propagate the return value from bnxt_alloc_one_tpa_info_data(); on allocation failure, unwind the partial initialization and free the ring buffers before the partially initialized ring is installed by bnxt_queue_start().
Event History
Frequently Asked Questions
What conditions are required for this issue to occur?
A TPA buffer allocation must fail during bnxt_queue_mem_alloc(), leaving some rxr->rx_tpa[] entries uninitialized. The affected code then installs the partially initialized receive ring, and hardware must select an aggregation ID that maps to one of those uninitialized entries.
What is the potential impact of the partially initialized ring?
An uninitialized rxr->rx_tpa[] slot can result in a zero DMA address being handed to the device. The supplied information does not state a specific attacker capability or resulting security impact beyond this invalid device DMA address condition.
How does the fix address the problem?
The fix checks the return value from bnxt_alloc_one_tpa_info_data(). If allocation fails, it unwinds the setup and frees the ring buffers instead of starting a queue with a partially initialized ring.