CVE-2026-97571 - bnxt_en: Propagate TPA buffer allocation failures in bnxt_queue_mem_alloc()

bnxt_en: Propagate TPA buffer allocation failures in bnxt_queue_mem_alloc()

Published Sep 25, 2026

No CVSS score

EPSS 0.20%

Description

bnxt_alloc_one_tpa_info_data() returns -ENOMEM as soon as one allocation fails. This leaves the remaining rxr->rx_tpa[] entries zeroed.

bnxt_queue_mem_alloc() discards that return value, so the partially initialized ring is installed by bnxt_queue_start().

Since the agg_id is picked by the hardware and bnxt_alloc_agg_idx maps it to a SW index in rxr->rx_tpa[], it is possible that an uninitialized slot can be chosen which would hand a zero DMA address to the device.

Fix this by checking the return value of bnxt_alloc_one_tpa_info_data and unwinding, freeing the ring buffers.

Affected products

Vendor Linux Product Linux Default
unaffected
- Version
  
  Status
  affected
  Constraints
- Version
  
  Status
  affected
  Constraints
- Version
  
  Status
  affected
  Constraints
- Version
  
  Status
  affected
  Constraints
Vendor Linux Product Linux Default
unaffected
- Version
  6.12.20
  Status
  affected
  Constraints
  <6.12.112
Vendor Linux Product Linux Default
affected
- Version
  6.13
  Status
  affected
  Constraints
  -
- Version
  0
  Status
  unaffected
  Constraints
  <6.13
- Version
  6.12.112
  Status
  unaffected
  Constraints
  <=6.12.*
- Version
  6.18.53
  Status
  unaffected
  Constraints
  <=6.18.*
- Version
  7.2.7
  Status
  unaffected
  Constraints
  <=7.2.*
- Version
  7.3-rc3
  Status
  unaffected
  Constraints
  <=*

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Linux

unaffected

Version	Status	Constraints
	affected
	affected
	affected
	affected

Linux

unaffected

Version	Status	Constraints
6.12.20	affected	<6.12.112

Linux

affected

Version	Status	Constraints
6.13	affected	-
0	unaffected	<6.13
6.12.112	unaffected	<=6.12.*
6.18.53	unaffected	<=6.18.*
7.2.7	unaffected	<=7.2.*
7.3-rc3	unaffected	<=*

Remediation

No remediation recorded yet.

Weaknesses (0)

No CWE recorded.

References (5)

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-86879		Advisory
https://git.kernel.org/stable/c/37e08dc821a57fe0592c917486b638caa888b46d
https://git.kernel.org/stable/c/b814dfbfeb0a68c9a52073f2caa05a2d5247a329
https://git.kernel.org/stable/c/c8050386a2209b2a474c1eb4bd1574dc19129bfb
https://git.kernel.org/stable/c/d7db2e4953e4626339fd0075564a3e447650d37b