CVE-2026-97573

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

bnxt_en: Handle buffer allocation failure in bnxt_rx_ring_reset()

bnxt_rx_ring_reset() frees the ring buffers and then reallocates them,

ignoring the result.

bnxt_alloc_one_rx_ring() can fail in bnxt_alloc_one_tpa_info_data(), which

returns -ENOMEM on the first failed allocation and leaves the remaining

rxr->rx_tpa[] entries zeroed.

The error isn't propagated up, so the loop in bnxt_rx_ring_reset

continues and at the end the code re-enables TPA with partially

unallocated rx_tpa array.

This means that when the agg_id from hardware is mapped to a SW index in

rxr->rx_tpa[], an uninitialized slot can be chosen which would hand a

zero DMA address to the device.

Fix this by falling back to a global reset, which is what the existing

code already does when other functions fail, but unlike the other

failure cases this particular failure has to return because TPA can't

be re-enabled since the allocation failed.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References