CVE-2026-97570

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

bnxt_en: Bound SW TPA IDs to prevent crashes

FW supports up to 1024 concurrent TPAs, so the FW TPA ID is in the range

0..1023 (see commit ec4d8e7cf024 ("bnxt_en: Add TPA ID mapping logic for

57500 chips.")). bnxt_alloc_agg_idx is intended to wrap the FW ID down to a

software ID which is used to index rxr->rx_tpa, and to generate a mapping

between FW IDs and the wrapped software ID.

On a 57608 with firmware version 233, the firmware advertises 32

concurrent TPAs. As of the commit under fixes, bp->max_tpa on this NIC

is set to 32.

If the software ID from bnxt_alloc_agg_idx is above 31, this results in

an invalid address being loaded on this line:

tpa_info = &rxr->rx_tpa[agg_id];

because rx_tpa is allocated with only bp->max_tpa (32) entries. Writes

to tpa_info later in the code are out of bounds.

This bug results in a crash at boot:

Oops: general protection fault, kernel NULL pointer dereference 0x8: 0000 [#1]

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References