CVE-2026-97571

A flaw was found in the Linux kernel's Broadcom NetXtreme-E (bnxt_en) network driver. The driver does not properly handle memory allocation failures when configuring Transparent Packet Aggregation (TPA) buffers, leaving partially initialized ring buffers active. When memory allocation fails, an uninitialized descriptor with an invalid Direct Memory Access (DMA) address can be passed to the network device, which may trigger a system crash and lead to a Denial of Service (DoS).

A flaw was found in the Linux kernel's Broadcom NetXtreme-E (bnxt_en) network driver, rated Moderate by Red Hat Product Security. bnxt_queue_mem_alloc() ignores the error return of bnxt_alloc_one_tpa_info_data(), so when a Transparent Packet Aggregation (TPA) buffer allocation fails with -ENOMEM, a partially initialized receive ring is still installed by bnxt_queue_start(). Because the hardware-selected aggregation ID can map to an uninitialized rx_tpa[] entry, a zero DMA address may be handed to the device, which can trigger DMA errors, device failure, or a kernel crash, resulting in denial of service. Exploiting this requires local access with privileges to (re)configure the network interface on a system equipped with affected Broadcom NetXtreme-E hardware, and it also depends on inducing a memory allocation failure, which limits practical exploitability. The vulnerable code is present in Red Hat Enterprise Linux 9 (rhel-9.8.z, rhel-9.9, rhel-9.10) and Red Hat Enterprise Linux 10 (rhel-10.2.z, rhel-10.3, rhel-10.4) kernels, in Red Hat In-Vehicle OS 2, and in OpenShift Container Platform 4.22, 4.23, 5.0, and 5.1 (RHEL CoreOS 9 based). Fixes for these streams are currently deferred because the flaw can only be triggered under memory allocation failure conditions by a privileged local user, and the residual risk is limited to denial of service on hosts using the affected bnxt_en hardware. Red Hat Enterprise Linux 6, 7, and 8, the earlier RHEL 9 and RHEL 10 minor streams, and OpenShift Container Platform 4.12 through 4.21 are not affected because the vulnerable code is not present. Red Hat assigned a CVSS 3.1 base score of 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), reflecting the local attack vector with no impact on confidentiality or integrity.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.