UBUNTU-CVE-2026-97573: High severity ubuntu/linux-hwe-edge vulnerability
In the Linux kernel, the following vulnerability has been resolved: bnxten: Handle buffer allocation failure in bnxtrxringreset() bnxtrxringreset() frees the ring buffers and then reallocates them, ignoring the result. bnxtalloconerxring() can fail in bnxtalloconetpainfodata(), which returns -ENOMEM on the first failed allocation and leaves the remaining rxr->rxtpa[] entries zeroed. The error isn't propagated up, so the loop in bnxtrxringreset continues and at the end the code re-enables TPA with partially unallocated rxtpa array. This means that when the aggid from hardware is mapped to a SW index in rxr->rxtpa[], an uninitialized slot can be chosen which would hand a zero DMA address to the device. Fix this by falling back to a global reset, which is what the existing code already does when other functions fail, but unlike the other failure cases this particular failure has to return because TPA can't be re-enabled since the allocation failed.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
In bnxt_rx_ring_reset(), fall back to a global reset when buffer allocation fails and return from the failure path so TPA is not re-enabled with partially unallocated rx_tpa entries.