CVE-2026-74269 in Linux
Summary
by MITRE • 08/15/2026
In the Linux kernel, the following vulnerability has been resolved:
bnxt: fix head underflow on XDP head-grow
The xdp.py test test_xdp_native_adjst_head_grow_data crashes when run on a bnxt machine (and also crashes in NIPA).
It seems that the bug is an underflow in bnxt_rx_multi_page_skb, which builds the skb head:
napi_build_skb(data_ptr - bp->rx_offset, rxr->rx_page_size);
The problem with this expression is that in page mode, rx_offset is:
bp->rx_offset = NET_IP_ALIGN + XDP_PACKET_HEADROOM;
Which evaluates (at least on x86_64) to 258.
The test test_xdp_native_adjst_head_grow_data tests a case where the head is adjusted by -256.
When this test runs, data_ptr is shifted to frag_start + 2 (where frag_start = page_address(page) + offset).
Then, bnxt_rx_multi_page_skb is invoked and the napi_build_skb expression subtracts 258, landing at an address before frag_start. This could be either the previous fragment or the previous physical page when the offset is < 256 (e.g. if the fragment started at offset 0).
When the skb is freed, the page pool fragment reference is dropped on either the wrong page or the wrong frag of the right page. In either case, the corrupted reference count can lead to the page being prematurely recycled while still in use. Once (incorrectly) recycled, it can be handed out again and on driver teardown this would result in a double free.
The commit under fixes updated this code to handle the case where the native page size is >= 64k, but it unintentionally broke the head grow case.
To fix this, add an offset field to struct bnxt_sw_rx_bd, mirroring the existing offset field in struct bnxt_sw_rx_agg_bd. Populate it on allocation and preserve it on reuse.
In bnxt_rx_multi_page_skb, use the newly added offset field to compute the fragment start and pass that to napi_build_skb. Adjust the layout with skb_reserve.
There are two cases, the non-adjustment case and the adjustment case.
In both cases, the skb is built at page_address(page) + offset to account for the case where the native page size >= 64K and skb_reserve is called with data_ptr - (page_address(page) + offset). That difference equals bp->rx_offset when data_ptr was not moved, or bp->rx_offset + xdp_adjust when XDP adjusted the head.
Re-running the failing test with this commit applied causes the test to run successfully to completion.
The other rx_skb_func implementations don't have this issue.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 08/15/2026
This vulnerability affects the bnxt network driver in the Linux kernel and represents a critical memory safety issue that can lead to system instability and potential security risks. The problem manifests as a head underflow during XDP (eXpress Data Path) packet processing when the head is adjusted using the xdp_adjust_head function. The issue specifically occurs in the bnxt_rx_multi_page_skb function where improper calculation of buffer offsets leads to incorrect memory reference handling.
The technical flaw stems from an arithmetic underflow in the buffer management logic where bp->rx_offset is calculated as NET_IP_ALIGN + XDP_PACKET_HEADROOM, which evaluates to 258 bytes on x86_64 architectures. When the test_xdp_native_adjst_head_grow_data executes with a head adjustment of -256 bytes, the data_ptr gets shifted to frag_start + 2, but the subsequent calculation in napi_build_skb subtracts 258 bytes, resulting in an address that lies before the actual fragment start. This misalignment causes the kernel's page management system to reference incorrect physical pages or fragments.
The operational impact of this vulnerability extends beyond simple test failures, as it creates a race condition in memory management that can result in corrupted page reference counts. When the skb (socket buffer) is freed, the incorrect page pool fragment references lead to premature page recycling while still being actively used by the network driver. This fundamental memory corruption can cause double free conditions during driver teardown operations, potentially leading to kernel panics or exploitable memory corruption scenarios.
The fix implements a targeted approach by adding an offset field to the struct bnxt_sw_rx_bd structure, mirroring existing functionality in struct bnxt_sw_rx_agg_bd. This modification ensures proper tracking of fragment start positions regardless of page size configurations. The solution addresses both adjustment and non-adjustment cases by building skbs at page_address(page) + offset and properly handling skb_reserve calculations with the difference between data_ptr and the computed fragment start address.
This vulnerability aligns with CWE-129 Input Validation and CWE-787 Out-of-bounds Write categories, representing a classic buffer over-read condition that can escalate to privilege escalation or denial of service scenarios. The ATT&CK framework would categorize this under T1059 Command and Scripting Interpreter and potentially T1499 Endpoint Denial of Service, as the vulnerability enables system instability through memory corruption. The fix demonstrates proper defensive programming practices by ensuring correct offset management in high-performance network processing paths while maintaining compatibility with existing driver functionality across different page size configurations including the 64K native page size scenario that was inadvertently broken in a previous commit.