{"id":"CVE-2026-97570","revision":"c0c85b7979f5411ab58199ab40a5c286","records":[{"revision":"c0c85b7979f5411ab58199ab40a5c286","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-97570","aliases":[],"title":"bnxt_en: Bound SW TPA IDs to prevent crashes","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nbnxt_en: Bound SW TPA IDs to prevent crashes\n\nFW supports up to 1024 concurrent TPAs, so the FW TPA ID is in the range\n0..1023 (see commit ec4d8e7cf024 (\"bnxt_en: Add TPA ID mapping logic for\n57500 chips.\")). bnxt_alloc_agg_idx is intended to wrap the FW ID down to a\nsoftware ID which is used to index rxr->rx_tpa, and to generate a mapping\nbetween FW IDs and the wrapped software ID.\n\nOn a 57608 with firmware version 233, the firmware advertises 32\nconcurrent TPAs. As of the commit under fixes, bp->max_tpa on this NIC\nis set to 32.\n\nIf the software ID from bnxt_alloc_agg_idx is above 31, this results in\nan invalid address being loaded on this line:\n\n  tpa_info = &rxr->rx_tpa[agg_id];\n\nbecause rx_tpa is allocated with only bp->max_tpa (32) entries. Writes\nto tpa_info later in the code are out of bounds.\n\nThis bug results in a crash at boot:\n\nOops: general protection fault, kernel NULL pointer dereference 0x8: 0000 [#1] SMP NOPTI\nRIP: 0010:bnxt_rx_pkt+0xc0/0x1560\nRSP: 0018:ffffc900009b8c78 EFLAGS: 00010246\nRAX: 0000000000000000 RBX: 0000000000000048 RCX: 0000000206682516\nRDX: ffffc900009b8db4 RSI: 0000000000000000 RDI: 01ffffff038fe1c0\nRBP: ffffc9006e687480 R08: ffffc9006e687000 R09: 0000000000003048\nR10: 0000000000000480 R11: ffff8881c6083900 R12: 0000000006682516\nR13: ffff8881c6095400 R14: 0000000000000016 R15: ffff8881c6b66680\nFS:  0000000000000000(0000) GS:ffff88fef3c77000(0000) knlGS:0000000000000000\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 00007fc8bda40584 CR3: 000000807c812001 CR4: 0000000008772ef0\nPKRU: 55555554\nCall Trace:\n <IRQ>\n ? __netif_receive_skb_list_core+0x1ca/0x250\n __bnxt_poll_work+0x152/0x280\n bnxt_poll_p5+0x1cd/0x480\n __napi_poll+0x30/0x180\n net_rx_action+0x20b/0x3b0\n ? note_gp_changes+0x53/0xe0\n ? tick_setup_sched_timer+0x180/0x180\n ? __napi_schedule+0x9a/0xb0\n ? bnxt_msix+0x24/0x30\n handle_softirqs+0xdd/0x2c0\n __irq_exit_rcu.llvm.3171231171502365008+0x47/0xf0\n common_interrupt+0x85/0x90\n </IRQ>\n <TASK>\n asm_common_interrupt+0x22/0x40\n\nThis stack trace is from a crash triggered when an out of bounds rx_tpa\nis dereferenced. The invalid write mentioned above is silent in this\nparticular crash.\n\nFix this by allocating rx_tpa with bp->max_tpa rounded up to the next\npower of 2 (bp->max_tpa_roundup_size) entries and masking the FW TPA ID\nwith that size, so the wrapped ID can never index past the end of the\narray.","state":0,"publishedAt":"2026-09-25T10:21:55.604+00:00","modifiedAt":"2026-10-19T09:09:32.95+00:00","affected":[{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"drivers/net/ethernet/broadcom/bnxt/bnxt.c\",\n                        \"drivers/net/ethernet/broadcom/bnxt/bnxt.h\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"54c28fab2fa5afd681c9c4b10f4f6da1efdd397a\",\n                            \"lessThan\": \"05cf64d171772c65bcdee76ee7163c35d9f55a89\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"54c28fab2fa5afd681c9c4b10f4f6da1efdd397a\",\n                            \"lessThan\": \"c0aceaf65b70b3c000e70dd867f3a673015f24ca\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"affected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"drivers/net/ethernet/broadcom/bnxt/bnxt.c\",\n                        \"drivers/net/ethernet/broadcom/bnxt/bnxt.h\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"7.1\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"0\",\n                            \"lessThan\": \"7.1\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.2.7\",\n                            \"lessThanOrEqual\": \"7.2.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.3\",\n                            \"lessThanOrEqual\": \"*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"original_commit_for_fix\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","score":8.1,"severity":"HIGH"}],"references":["https://git.kernel.org/stable/c/05cf64d171772c65bcdee76ee7163c35d9f55a89","https://git.kernel.org/stable/c/c0aceaf65b70b3c000e70dd867f3a673015f24ca"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-97570","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-97570","identifiers":["CVE-2026-97570"]},"retained":false,"historicalAffected":[]}],"coverage":[]}