CVE-2026-43260
HighSummary
A vulnerability related to the RSS context deletion logic in the bnxt_en driver has been fixed in the Linux kernel. The issue was that an incorrect check of the network interface state led to VNIC leaks in firmware, potentially resulting in the loss of active RSS contexts.
Risk Assessment
The organization may lose active RSS contexts, impacting network performance and stability. Additionally, improper resource management could lead to service availability issues.
Recommendation
It is recommended to update the Linux kernel to the latest version to eliminate this vulnerability and improve RSS context management. Also, monitor systems for potential issues related to VNIC.
Other vulnerabilities in Linux kernel, bnxt_en driver
See all- CVE-2026-99081High
In the Linux kernel, the bnxt_en driver has a DMA mapping length bug for padded small packets. bnxt_start_xmit() pads packets smaller than 52 bytes, but the length passed to dma_map_single() is not adjusted, so the NIC DMA engine reads beyond the mapped region, causing IOMMU faults and transmit queue timeouts.
- CVE-2026-97570High
In the Linux kernel, the bnxt_en driver has an out-of-bounds write in bnxt_alloc_agg_idx. When firmware advertises fewer concurrent TPAs (e.g., 32) than the maximum, the TPA ID can exceed the size of the rx_tpa array, leading to invalid memory access and a kernel crash at boot.
- CVE-2026-97569Low risk· EPSS 11%
In the Linux kernel, the bnxt_en driver has a bug that can cause the transmit queue to stop. When the driver defers completions for a burst of packets and then a large USO packet cannot fit in a small ring, the ring may become full of packets with suppressed completions, permanently stalling the queue. This affects small rings (up to 457 descriptors) and was fixed by clearing the NO_CMPL bit in bnxt_txr_db_kick().
Original NVD description (English source)
In the Linux kernel, the following vulnerability has been resolved: bnxt_en: Fix RSS context delete logic We need to free the corresponding RSS context VNIC in FW everytime an RSS context is deleted in driver. Commit 667ac333dbb7 added a check to delete the VNIC in FW only when netif_running() is true to help delete RSS contexts with interface down. Having that condition will make the driver leak VNICs in FW whenever close() happens with active RSS contexts. On the subsequent open(), as part of RSS context restoration, we will end up trying to create extra VNICs for which we did not make any reservation. FW can fail this request, thereby making us lose active RSS contexts. Suppose an RSS context is deleted already and we try to process a delete request again, then the HWRM functions will check for validity of the request and they simply return if the resource is already freed. So, even for delete-when-down cases, netif_running() check is not necessary. Remove the netif_running() c
Vulnerability data from NVD (NIST) · CISA KEV · EPSS