CVE-2026-23041 in Linux
Summary
by MITRE • 02/04/2026
In the Linux kernel, the following vulnerability has been resolved:
bnxt_en: Fix NULL pointer crash in bnxt_ptp_enable during error cleanup
When bnxt_init_one() fails during initialization (e.g., bnxt_init_int_mode returns -ENODEV), the error path calls bnxt_free_hwrm_resources() which destroys the DMA pool and sets bp->hwrm_dma_pool to NULL. Subsequently, bnxt_ptp_clear() is called, which invokes ptp_clock_unregister().
Since commit a60fc3294a37 ("ptp: rework ptp_clock_unregister() to disable events"), ptp_clock_unregister() now calls ptp_disable_all_events(), which in turn invokes the driver's .enable() callback (bnxt_ptp_enable()) to disable PTP events before completing the unregistration.
bnxt_ptp_enable() attempts to send HWRM commands via bnxt_ptp_cfg_pin() and bnxt_ptp_cfg_event(), both of which call hwrm_req_init(). This function tries to allocate from bp->hwrm_dma_pool, causing a NULL pointer dereference:
bnxt_en 0000:01:00.0 (unnamed net_device) (uninitialized): bnxt_init_int_mode err: ffffffed KASAN: null-ptr-deref in range [0x0000000000000028-0x000000000000002f]
Call Trace: __hwrm_req_init (drivers/net/ethernet/broadcom/bnxt/bnxt_hwrm.c:72) bnxt_ptp_enable (drivers/net/ethernet/broadcom/bnxt/bnxt_ptp.c:323 drivers/net/ethernet/broadcom/bnxt/bnxt_ptp.c:517) ptp_disable_all_events (drivers/ptp/ptp_chardev.c:66) ptp_clock_unregister (drivers/ptp/ptp_clock.c:518) bnxt_ptp_clear (drivers/net/ethernet/broadcom/bnxt/bnxt_ptp.c:1134) bnxt_init_one (drivers/net/ethernet/broadcom/bnxt/bnxt.c:16889)
Lines are against commit f8f9c1f4d0c7 ("Linux 6.19-rc3")
Fix this by clearing and unregistering ptp (bnxt_ptp_clear()) before freeing HWRM resources.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 04/30/2026
This vulnerability exists within the Linux kernel's bnxt_en network driver and represents a critical null pointer dereference that occurs during device initialization failure scenarios. The issue manifests when the bnxt_init_one() function encounters an error during hardware initialization, specifically when bnxt_init_int_mode returns -ENODEV. During the error cleanup process, the driver properly destroys the DMA pool and sets bp->hwrm_dma_pool to NULL, but subsequently calls bnxt_ptp_clear() which invokes ptp_clock_unregister(). This sequence creates a dangerous race condition where the PTP subsystem attempts to disable events through the driver's enable callback, triggering the null pointer dereference.
The technical flaw stems from the interaction between the PTP subsystem's event management and the driver's resource cleanup sequence. When ptp_clock_unregister() is called, it invokes ptp_disable_all_events() as part of the commit a60fc3294a37 "ptp: rework ptp_clock_unregister() to disable events" which is a standard security practice to ensure proper cleanup of hardware event handling. The bnxt_ptp_enable() function, which serves as the driver's event enable callback, attempts to send HWRM commands through functions like bnxt_ptp_cfg_pin() and bnxt_ptp_cfg_event(), both of which call hwrm_req_init(). This function tries to allocate memory from the already-freed bp->hwrm_dma_pool, causing the null pointer dereference at address 0x0000000000000028. The vulnerability is classified as a CWE-476 NULL Pointer Dereference, which is a well-known weakness in software security that can lead to system crashes or potential privilege escalation.
The operational impact of this vulnerability is significant as it can cause system crashes or kernel oops during device initialization failure scenarios, particularly affecting network devices using the bnxt_en driver such as Broadcom network adapters. This represents a direct threat to system stability and availability, especially in production environments where network device initialization failures may occur due to hardware issues, driver mismatches, or configuration errors. The vulnerability affects the Linux kernel versions around 6.19-rc3 and demonstrates a failure in proper resource management during error paths. The attack surface is limited to systems using the specific Broadcom network drivers with PTP support, but the impact is severe as it can lead to complete system crashes and denial of service conditions.
The fix implemented addresses the root cause by reordering the cleanup sequence to ensure that PTP resources are cleared and unregistered before HWRM resources are freed. This follows the principle of proper resource management and ensures that the driver's cleanup path does not attempt to access freed memory structures. The mitigation strategy involves calling bnxt_ptp_clear() before bnxt_free_hwrm_resources() in the error path, preventing the null pointer dereference. This approach aligns with the ATT&CK framework's defense evasion techniques by ensuring proper cleanup of system resources during error conditions, and it follows the security best practice of resource validation before memory access. The fix also aligns with the Linux kernel's security guidelines for driver development, particularly around error handling and resource management during device initialization failures, where proper ordering of cleanup operations is crucial to prevent undefined behavior and system instability.