bnxt_en: Propagate RX ring init failures in bnxt_init_nic() (CVE-2026-97572) | HOL Guard CVE

Unknown severity · Source severity not reportedCVE-2026-97572

bnxt_en: Propagate RX ring init failures in bnxt_init_nic()

Answer in brief

CVE-2026-97572 records a Unknown severity vulnerability in bnxt_en: Propagate RX ring init failures in bnxt_init_nic(). The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.

Analysis pending evidence review

HOL Guard separates source facts from reviewed analysis. See the methodology.

Published Sep 25, 2026Updated Sep 25, 2026Source checked Sep 25, 2026First seen by HOL Sep 25, 2026Material review Sep 25, 2026

Upstream Advisory

Key facts

Risk: Unknown severitySource severity not reported
Exploitation: Not marked as known exploited
Affected software: 2 mapped packages or products
Fix availability: Available

Why this deserves its current priority

A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.

Analysis status

Analysis pending evidence review

Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.

Affected scope and exposure questions

The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.

Mapped affected packages and fixed versions
Package	Affected range	Fixed version
Linux/Linuxgeneric	>=c0c050c58d840994ba842ad1c338a98e7c12b764 <daadccd062fdca5e77a8cc22ffe35857803b6c49 \|\| >=c0c050c58d840994ba842ad1c338a98e7c12b764 <b4c40f2c80d7bf50648878bc206a39adfbfaec6c \|\| >=c0c050c58d840994ba842ad1c338a98e7c12b764 <dfd73af81cdb9f7b399754a59e2658a08211bee5 \|\| >=c0c050c58d840994ba842ad1c338a98e7c12b764 <8e6a850c0746bb4be167aedf1ee57469fcda09a9	daadccd062fdca5e77a8cc22ffe35857803b6c49, b4c40f2c80d7bf50648878bc206a39adfbfaec6c, dfd73af81cdb9f7b399754a59e2658a08211bee5, 8e6a850c0746bb4be167aedf1ee57469fcda09a9
Linux/Linuxgeneric	4.4	Not reported

Recommended response

Check inventory. Check lockfiles and deployed manifests for Linux/Linux, Linux/Linux.
Review the reported fix. Update Linux/Linux to daadccd062fdca5e77a8cc22ffe35857803b6c49 if you use the affected versions. Test the change in a non-production environment first.

Evidence timeline and material changes

Published upstream
Sep 25, 2026
Evidence: source:cvelist:source_dates:source-dates:record
Source modified
Sep 25, 2026
Evidence: source:cvelist:source_dates:source-dates:record
First seen by HOL
Sep 25, 2026

Sources and claim methodology

Upstream source description

In the Linux kernel, the following vulnerability has been resolved: bnxt_en: Propagate RX ring init failures in bnxt_init_nic() bnxt_init_rx_rings() returns an error when bnxt_alloc_one_rx_ring() fails, but bnxt_init_nic() discards that return value and calls bnxt_init_chip(), which enables TPA. If an allocation fails, this could leave rxr->rx_tpa[] partially zeroed and TPA would be enabled over an array with zeroed entries. This would lead to a zeroed DMA address being handed out if the agg_idx is translated to a SW index at a zeroed entry. Fix this by propagating the error out of bnxt_init_nic(). Both callers already check its return value and unwind with bnxt_free_skbs() and bnxt_free_mem(), which tolerate a partially initialized RX ring.

Quoted source text, attributed separately from HOL analysis.