CVE-2026-80998

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

net: bnxt: ring the doorbell when SW USO exits early

When a burst of packets is handed down to the driver, the driver defers

the doorbell to the end by setting txr->kick_pending = 1. The normal TX

path handles this, but the SW USO path can miss it if it returns

early.

If bnxt_sw_udp_gso_xmit runs but returns early with NETDEV_TX_BUSY and

txr->kick_pending was previously set to 1, then the TX queue can

stall because the driver wrote some BDs but never wrote the doorbell.

The device won't know to do the TX which would generate the completion

that would wake the queue back up.

Simplify bnxt_sw_udp_gso_xmit to set txr->kick_pending in its success

case and check the flag on return. The added check after

bnxt_sw_udp_gso_xmit returns ensures that any pending doorbells are

written handling both successful USO and any early returns, which

prevents the TX queue stall mentioned above.

This TX queue stall was observed on a pr

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References