CVE-2026-97572

bnxt_en: Propagate RX ring init failures in bnxt_init_nic()

State: Published
Severity: Not scored
Published: Sep 25, 2026
Updated: Oct 19, 2026
Reserved: Sep 24, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

bnxt_en: Propagate RX ring init failures in bnxt_init_nic()

bnxt_init_rx_rings() returns an error when bnxt_alloc_one_rx_ring() fails, but bnxt_init_nic() discards that return value and calls bnxt_init_chip(), which enables TPA.

If an allocation fails, this could leave rxr->rx_tpa[] partially zeroed and TPA would be enabled over an array with zeroed entries. This would lead to a zeroed DMA address being handed out if the agg_idx is translated to a SW index at a zeroed entry.

Fix this by propagating the error out of bnxt_init_nic(). Both callers already check its return value and unwind with bnxt_free_skbs() and bnxt_free_mem(), which tolerate a partially initialized RX ring.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	c0c050c58d840994ba842ad1c338a98e7c12b764 to before e40641638743b4b848d5ed78a0565afffc359d8eAffected c0c050c58d840994ba842ad1c338a98e7c12b764 to before 6b24eca42619b93f69aebc2aa0a9fd28ac9a5085Affected c0c050c58d840994ba842ad1c338a98e7c12b764 to before 1f2d333ae2e1a73b7cc1c2a627587024cd147c01Affected c0c050c58d840994ba842ad1c338a98e7c12b764 to before c3eb07e78e628243cbb9bbb0115db802fb7a303fAffected c0c050c58d840994ba842ad1c338a98e7c12b764 to before daadccd062fdca5e77a8cc22ffe35857803b6c49Affected c0c050c58d840994ba842ad1c338a98e7c12b764 to before b4c40f2c80d7bf50648878bc206a39adfbfaec6cAffected c0c050c58d840994ba842ad1c338a98e7c12b764 to before dfd73af81cdb9f7b399754a59e2658a08211bee5Affected c0c050c58d840994ba842ad1c338a98e7c12b764 to before 8e6a850c0746bb4be167aedf1ee57469fcda09a9Affected
LinuxLinux	4.4Affected before 4.4Not affected 5.10.271 through 5.10.Not affected 5.15.222 through 5.15.Not affected 6.1.189 through 6.1.Not affected 6.6.158 through 6.6.Not affected 6.12.111 through 6.12.Not affected 6.18.53 through 6.18.Not affected 7.2.7 through 7.2.*Not affected 7.3 and laterNot affected

Product

Versions

LinuxLinux

c0c050c58d840994ba842ad1c338a98e7c12b764 to before e40641638743b4b848d5ed78a0565afffc359d8eAffected
c0c050c58d840994ba842ad1c338a98e7c12b764 to before 6b24eca42619b93f69aebc2aa0a9fd28ac9a5085Affected
c0c050c58d840994ba842ad1c338a98e7c12b764 to before 1f2d333ae2e1a73b7cc1c2a627587024cd147c01Affected
c0c050c58d840994ba842ad1c338a98e7c12b764 to before c3eb07e78e628243cbb9bbb0115db802fb7a303fAffected
c0c050c58d840994ba842ad1c338a98e7c12b764 to before daadccd062fdca5e77a8cc22ffe35857803b6c49Affected
c0c050c58d840994ba842ad1c338a98e7c12b764 to before b4c40f2c80d7bf50648878bc206a39adfbfaec6cAffected
c0c050c58d840994ba842ad1c338a98e7c12b764 to before dfd73af81cdb9f7b399754a59e2658a08211bee5Affected
c0c050c58d840994ba842ad1c338a98e7c12b764 to before 8e6a850c0746bb4be167aedf1ee57469fcda09a9Affected

LinuxLinux

4.4Affected
before 4.4Not affected
5.10.271 through 5.10.*Not affected
5.15.222 through 5.15.*Not affected
6.1.189 through 6.1.*Not affected
6.6.158 through 6.6.*Not affected
6.12.111 through 6.12.*Not affected
6.18.53 through 6.18.*Not affected
7.2.7 through 7.2.*Not affected
7.3 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.