Linux kernel (bnxt_en driver) vulnerabilities

In the Linux kernel, the bnxt_en driver has an out-of-bounds write in bnxt_alloc_agg_idx. When firmware advertises fewer concurrent TPAs (e.g., 32) than the maximum, the TPA ID can exceed the size of the rx_tpa array, leading to invalid memory access and a kernel crash at boot.

In the Linux kernel, the bnxt_en driver has a bug that can cause the transmit queue to stop. When the driver defers completions for a burst of packets and then a large USO packet cannot fit in a small ring, the ring may become full of packets with suppressed completions, permanently stalling the queue. This affects small rings (up to 457 descriptors) and was fixed by clearing the NO_CMPL bit in bnxt_txr_db_kick().

A vulnerability related to the RSS context deletion logic in the bnxt_en driver has been fixed in the Linux kernel. The issue was that an incorrect check of the network interface state led to VNIC leaks in firmware, potentially resulting in the loss of active RSS contexts.