CVE-2026-97573: bnxt_en: Handle buffer allocation failure in bnxt_rx_ring_reset()
In the Linux kernel, the following vulnerability has been resolved:
bnxten: Handle buffer allocation failure in bnxtrxringreset()
bnxtrxringreset() frees the ring buffers and then reallocates them, ignoring the result.
bnxtalloconerxring() can fail in bnxtalloconetpainfodata(), which returns -ENOMEM on the first failed allocation and leaves the remaining rxr->rxtpa[] entries zeroed.
The error isn't propagated up, so the loop in bnxtrxringreset continues and at the end the code re-enables TPA with partially unallocated rxtpa array.
This means that when the aggid from hardware is mapped to a SW index in rxr->rxtpa[], an uninitialized slot can be chosen which would hand a zero DMA address to the device.
Fix this by falling back to a global reset, which is what the existing code already does when other functions fail, but unlike the other failure cases this particular failure has to return because TPA can't be re-enabled since the allocation failed.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
In bnxt_rx_ring_reset, fall back to a global reset when bnxt_alloc_one_rx_ring() or bnxt_alloc_one_tpa_info_data() fails, rather than re-enabling TPA with partially allocated rxr->rx_tpa[] entries.
Event History
Frequently Asked Questions
What conditions are required to trigger this issue?
The receive-ring reset path must run, and allocation of TPA information data must fail with an out-of-memory condition. The failure leaves some rx_tpa entries unallocated, but the affected code continues and re-enables TPA.
What is the practical impact of the failed allocation?
Hardware aggregation IDs can map to an uninitialized rx_tpa slot, causing a zero DMA address to be provided to the device. The supplied data does not state a specific attacker-controlled trigger or impact beyond this invalid DMA-address condition.
What does the fix do when TPA buffer allocation fails?
It stops the reset path from re-enabling TPA after the allocation failure and falls back to a global reset. This matches the existing handling for other reset-path failures.