CVE-2026-74745

A flaw was found in the Linux kernel's bnxt Ethernet driver. This vulnerability could allow a local attacker to cause a system deadlock. The deadlock occurs when the driver attempts to unregister an IRQ affinity notifier while holding a lock that is also required by the notifier's callback, leading to system unresponsiveness.

A flaw of low impact was found in the Linux kernel's Broadcom bnxt Ethernet driver. Unregistering an IRQ affinity notifier waits for the notifier callback synchronously, and the bnxt driver takes the netdev instance lock in that callback while also canceling the queued restart work under the same lock. This lock ordering can deadlock. A local attacker with the ability to trigger IRQ affinity changes on a system using affected bnxt hardware with TPH (Target Prefetch Hints) support could exploit this to cause a kernel deadlock that leaves the system unresponsive, resulting in denial of service. Confidentiality and integrity are not affected.

The vulnerable code was introduced together with TPH support in the bnxt driver and is present in Red Hat Enterprise Linux 9 and Red Hat Enterprise Linux 10 as well as in Red Hat In-Vehicle OS, which are therefore affected. Red Hat Enterprise Linux 6, 7, and 8, and the initial Red Hat Enterprise Linux 10.0 release, do not contain the vulnerable code and are not affected. Fixes for the affected streams are currently deferred to a future update. The residual risk of this deferral is limited: the flaw is not remotely triggerable and is not caused by normal network traffic, so exploitation requires local access with the ability to change IRQ affinity on the affected device.

Red Hat rates this flaw as Low impact, with a Red Hat CVSS 3.1 score of 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H). This differs from the upstream CVE record severity of Important (CVSS 7.5, AV:N), which assumes network reachability; the deadlock is in fact only triggerable locally through IRQ affinity notifier operations on affected bnxt hardware.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.