CVE-2026-74697

A flaw was found in the Linux kernel's bnxt_en driver. This vulnerability occurs when End of frame padding (EOP) on the AGG ring overlaps with subsequent data segments. On older network chips, if Relaxed Ordering (RO) is active, this overlap can cause valid data to be overwritten with zeros. This can lead to data corruption, impacting the integrity of information processed by the system.

bnxt_en can corrupt received packet data when EOP (End of frame padding) is used on AGG RX rings together with TPA and Relaxed Ordering. Zero padding at the end of one segment can overlap with data from the next segment, and on older chips such as P5 the hardware does not automatically disable Relaxed Ordering to prevent this. A remote peer may be able to influence the affected receive path by sending traffic to the Broadcom NIC, but practical triggering depends on specific hardware, ARM or ordering behavior, TPA being enabled, and RO being active. For the CVSS the PR:N is selected because the attacker does not need a local account when the vulnerable receive path is reachable by network traffic. Impact is primarily integrity loss due to corrupted received data and possible availability degradation, not a proven privilege escalation or information disclosure.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.