CVE-2026-97571: bnxt_en: Propagate TPA buffer allocation failures in bnxt_queue_mem_alloc()
In the Linux kernel, the following vulnerability has been resolved:
bnxten: Propagate TPA buffer allocation failures in bnxtqueuememalloc()
bnxtalloconetpainfodata() returns -ENOMEM as soon as one allocation fails. This leaves the remaining rxr->rxtpa[] entries zeroed.
bnxtqueuememalloc() discards that return value, so the partially initialized ring is installed by bnxtqueuestart().
Since the aggid is picked by the hardware and bnxtallocaggidx maps it to a SW index in rxr->rxtpa[], it is possible that an uninitialized slot can be chosen which would hand a zero DMA address to the device.
Fix this by checking the return value of bnxtalloconetpainfodata and unwinding, freeing the ring buffers.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Update bnxt_queue_mem_alloc() to check and propagate the return value of bnxt_alloc_one_tpa_info_data(); on allocation failure, unwind and free the ring buffers so a partially initialized ring is not installed by bnxt_queue_start().
Event History
Frequently Asked Questions
What conditions are required for this issue to occur?
A TPA buffer allocation must fail during bnxt_queue_mem_alloc(), leaving some rxr->rx_tpa[] entries uninitialized. The affected code then installs the partially initialized receive ring, and hardware must select an aggregation ID that maps to one of those uninitialized entries.
What is the potential impact of the partially initialized ring?
An uninitialized rxr->rx_tpa[] slot can result in a zero DMA address being handed to the device. The supplied information does not state a specific attacker capability or resulting security impact beyond this invalid device DMA address condition.
How does the fix address the problem?
The fix checks the return value from bnxt_alloc_one_tpa_info_data(). If allocation fails, it unwinds the setup and frees the ring buffers instead of starting a queue with a partially initialized ring.