CVE-2026-97574

A flaw was found in the Linux kernel's Broadcom NetXtreme-E (bnxt_en) network driver. When cloning receive ring structures during queue memory allocation, the driver fails to clear pointers to active Transparent Packet Aggregation (TPA) memory. If a subsequent memory allocation failure occurs, error-handling routines can prematurely free memory that remains in active use by the live ring. This issue may lead to memory corruption and result in a Denial of Service (DoS) through a system crash.

A moderate impact flaw was found in the Linux kernel's Broadcom NetXtreme-E (bnxt_en) network driver in Red Hat Enterprise Linux 9 and 10, Red Hat In-Vehicle OS 2, and OpenShift Container Platform streams that ship an affected RHEL 9 or RHEL 10 based kernel. When the driver clones a receive ring during queue memory allocation, the clone retains pointers to the live ring's Transparent Packet Aggregation (TPA) state. If a subsequent memory allocation fails during a queue restart, the error-handling path can free the live ring's TPA memory while it is still in active use, leading to memory corruption and a kernel crash that results in a local denial of service. Exploiting this flaw requires local access with privileges to reconfigure the network device (such as CAP_NET_ADMIN) combined with a memory allocation failure at the right point in the queue restart, so the crash cannot be deterministically forced by an attacker. Earlier Red Hat Enterprise Linux 6, 7, and 8 releases, the RHEL 9.2, 9.4, 9.6, and 10.0 update streams, kernel-rt, and OpenShift Container Platform 4.12 through 4.21 are not affected because the vulnerable code is not present in those kernels. Red Hat's severity of Moderate (CVSS 3.1 score 5.5) is lower than the upstream assessment because the flaw is local, requires privileges, and depends on an unreliable allocation-failure condition. For the affected streams the fix is deferred to a future planned update; the residual risk is limited to a local denial of service on systems using affected Broadcom NetXtreme-E network hardware, with no confidentiality or integrity impact expected.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.