CVE-2026-97570 in Linux
Summary
by MITRE • 09/25/2026
In the Linux kernel, the following vulnerability has been resolved:
bnxt_en: Bound SW TPA IDs to prevent crashes
FW supports up to 1024 concurrent TPAs, so the FW TPA ID is in the range 0..1023 (see commit ec4d8e7cf024 ("bnxt_en: Add TPA ID mapping logic for 57500 chips.")). bnxt_alloc_agg_idx is intended to wrap the FW ID down to a software ID which is used to index rxr->rx_tpa, and to generate a mapping between FW IDs and the wrapped software ID.
On a 57608 with firmware version 233, the firmware advertises 32 concurrent TPAs. As of the commit under fixes, bp->max_tpa on this NIC is set to 32.
If the software ID from bnxt_alloc_agg_idx is above 31, this results in an invalid address being loaded on this line:
tpa_info = &rxr->rx_tpa[agg_id];
because rx_tpa is allocated with only bp->max_tpa (32) entries. Writes to tpa_info later in the code are out of bounds.
This bug results in a crash at boot:
Oops: general protection fault, kernel NULL pointer dereference 0x8: 0000 [#1] SMP NOPTI
RIP: 0010:bnxt_rx_pkt+0xc0/0x1560 RSP: 0018:ffffc900009b8c78 EFLAGS: 00010246 RAX: 0000000000000000 RBX: 0000000000000048 RCX: 0000000206682516 RDX: ffffc900009b8db4 RSI: 0000000000000000 RDI: 01ffffff038fe1c0 RBP: ffffc9006e687480 R08: ffffc9006e687000 R09: 0000000000003048 R10: 0000000000000480 R11: ffff8881c6083900 R12: 0000000006682516 R13: ffff8881c6095400 R14: 0000000000000016 R15: ffff8881c6b66680 FS: 0000000000000000(0000) GS:ffff88fef3c77000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007fc8bda40584 CR3: 000000807c812001 CR4: 0000000008772ef0 PKRU: 55555554 Call Trace: <IRQ> ? __netif_receive_skb_list_core+0x1ca/0x250 __bnxt_poll_work+0x152/0x280 bnxt_poll_p5+0x1cd/0x480 __napi_poll+0x30/0x180 net_rx_action+0x20b/0x3b0 ? note_gp_changes+0x53/0xe0 ? tick_setup_sched_timer+0x180/0x180 ? __napi_schedule+0x9a/0xb0 ? bnxt_msix+0x24/0x30 handle_softirqs+0xdd/0x2c0 __irq_exit_rcu.llvm.3171231171502365008+0x47/0xf0 common_interrupt+0x85/0x90 </IRQ> <TASK> asm_common_interrupt+0x22/0x40
This stack trace is from a crash triggered when an out of bounds rx_tpa is dereferenced. The invalid write mentioned above is silent in this particular crash.
Fix this by allocating rx_tpa with bp->max_tpa rounded up to the next power of 2 (bp->max_tpa_roundup_size) entries and masking the FW TPA ID with that size, so the wrapped ID can never index past the end of the array.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/25/2026
The bnxt_en network driver in the Linux kernel contains a critical out-of-bounds memory access vulnerability rooted in an incorrect calculation of buffer sizes for Total Packet Aggregation identifiers. The firmware supports up to 1024 concurrent TPA sessions, meaning firmware-generated TPA IDs range from zero to one thousand twenty-three. The driver utilizes a function named bnxt_alloc_agg_idx to map these wide firmware identifiers into smaller software-specific indices that are used to access the rx_tpa array within the receive ring structure. This mapping logic is designed to wrap or constrain the identifier so it remains within valid bounds for the allocated data structures. However, on specific hardware such as the 57608 chip with firmware version two hundred thirty-three, the driver sets the maximum TPA count based on what the firmware advertises, which in this case is only thirty-two concurrent sessions.
The core technical flaw arises when the software ID generated by bnxt_alloc_agg_idx exceeds the actual size of the rx_tpa array. Since the array is allocated with exactly bp->max_tpa entries, which equals thirty-two in the affected scenario, any index greater than or equal to thirty-one results in an out-of-bounds access. When the code attempts to retrieve tpa_info by indexing into rx_tpa using this invalid agg_id, it accesses memory outside the bounds of the allocated structure. Subsequent writes to tpa_info further corrupt adjacent memory regions. This type of error is classified under CWE-125 as an out-of-bounds read and potentially CWE-787 as an out-of-bounds write depending on subsequent operations, representing a fundamental failure in boundary validation during array indexing.
The operational impact of this vulnerability manifests immediately upon system boot or when network traffic triggers the affected code path. The kernel encounters a general protection fault due to a null pointer dereference or invalid memory access, leading to an immediate crash and system panic. The stack trace indicates that the error occurs within bnxt_rx_pkt during packet processing, specifically triggered by interrupt handling routines such as __bnxt_poll_work and bnxt_poll_p5. This results in a denial of service condition where the host machine becomes unresponsive until rebooted. For environments relying on this hardware for critical network infrastructure, such instability poses significant availability risks and can lead to data loss or interrupted services depending on the timing of the crash relative to active connections.
The resolution involves modifying the allocation logic for the rx_tpa array to ensure it is sized appropriately to handle all possible wrapped indices without overflow. Specifically, the driver now allocates the array with a size rounded up to the next power of two based on bp->max_tpa_roundup_size rather than the raw maximum TPA count. Additionally, the firmware TPA ID is masked against this new size before being used as an index. This bitwise masking guarantees that the resulting software ID always falls within the valid range of the allocated array, effectively preventing any out-of-bounds access regardless of the specific hardware configuration or firmware version. This fix aligns with secure coding practices by ensuring memory safety through proper bounds checking and allocation sizing strategies recommended in industry standards for kernel development.