CVE-2026-97574: bnxt_en: Don't free the live ring's TPA state on queue restart failure
In the Linux kernel, the following vulnerability has been resolved:
bnxten: Don't free the live ring's TPA state on queue restart failure
bnxtqueuememalloc() shallow copies the live RX ring into the clone:
memcpy(clone, rxr, sizeof(rxr));
the code currently clears pointers that the clone owns (such as rxaggbmap), but rxtpa and rxtpaidxmap are left pointing at memory of the live ring that was cloned.
If an allocation failure happens later and the errfreetpainfo label is taken, the live ring's memory can be freed while still in use.
Fix this by initializing the clone's pointers to NULL to prevent live ring state from being freed inadvertently.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Initialize the clone's rx_tpa and rx_tpa_idx_map pointers to NULL before queue restart allocation, so an allocation failure cannot free the live ring's TPA state.
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
Systems using the Linux kernel bnxt_en driver may be affected when an RX queue restart reaches the vulnerable memory-allocation error path. The issue concerns TPA state associated with a live RX ring.
What has to happen for the vulnerability to be triggered?
A queue restart must shallow-copy a live RX ring, then encounter a later allocation failure that takes the err_free_tpa_info cleanup path. In that case, stale clone pointers can cause TPA memory belonging to the live ring to be freed while it remains in use.
How does the fix prevent the erroneous free?
The fix initializes the cloned ring's rx_tpa and rx_tpa_idx_map pointers to NULL. This prevents cleanup of the clone from freeing TPA state owned by the live ring.