Description

In the Linux kernel, the following vulnerability has been resolved: eth: bnxt: avoid deadlock when canceling IRQ affinity notifier Unregistering IRQ affinity notifiers waits for the callback synchronously. bnxt takes the netdev instance lock in the notifier (to restart the queue) and cancels the work under the same lock. This may obviously deadlock. Move the restart to the async service task. The queue restart isn't super time sensitive. Store the new TPH tag, schedule the task. Safely canceling the service task is already ironed out. In bnxt_request_irq() the order of registering notifier, affinity and initial TPH programming has to be inverted. I think it was racy previously since user may trigger an update as soon as notifier is installed. There's a small known gap - if pcie_tph_get_cpu_st() fails at init and the target tag is 0 we may miss programming the entry. This does not seem worth fixing, the code has skip-on-failure all over the place, anyway.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-26T15:16:53.387Z",
  "pubdate": "2026-08-26T15:16:53.387Z",
  "executiveSummary": "A deadlock vulnerability has been identified in the Linux kernel's Broadcom NetXtreme (bnxt) driver, specifically concerning the handling of IRQ affinity notifiers.\nThe vulnerability occurs due to a circular dependency between the IRQ affinity notifier unregistration process and the driver's internal queue management locks.\nAn attacker capable of triggering interface reconfigurations or IRQ affinity updates may induce a system-level deadlock, resulting in a Denial of Service (DoS) where the network interface becomes unresponsive and the kernel thread enters an unrecoverable wait state.\nThe issue affects the bnxt network driver's management of service tasks and queue restart logic during IRQ teardown.\nExploitation requires the ability to influence kernel-level driver states, typically achieved via system management or network configuration interfaces.\nThis vulnerability highlights a flaw in synchronous callback execution while holding critical mutexes within the driver's synchronization primitive architecture.",
  "technicalDetails": "The vulnerability resides within the interaction between the Linux kernel's IRQ affinity notifier subsystem and the bnxt_en driver's internal locking mechanisms. The core issue is a deadlock scenario triggered during the unregistration of IRQ affinity notifiers.\nWhen unregistering an IRQ affinity notifier, the kernel performs a synchronous wait for the registered callback to complete. Within the bnxt driver, the existing implementation of this callback attempts to acquire the netdev instance lock to initiate a queue restart. Simultaneously, the process responsible for canceling the IRQ-related work is also executing while holding the same netdev instance lock. This creates a classic AB-BA locking contention scenario, where the callback is waiting for the lock held by the caller, while the caller is blocked waiting for the callback to finish execution.\nTo exploit this, an attacker triggers a configuration change that forces the driver to unregister the notifier while the driver is performing internal state updates. By repeatedly invoking interface reconfigurations that trigger IRQ migration or affinity reassignment, an attacker can reliably cause the kernel to enter a deadlock state. Once triggered, the involved kernel thread becomes non-interruptible, effectively hanging the driver's service task.\nThe remediation involves decoupling the queue restart logic from the synchronous notifier context. By transitioning the restart logic to an asynchronous service task, the driver avoids holding the critical netdev lock during the notifier unregistration wait. Furthermore, the initialization sequence within bnxt_request_irq() was refactored to invert the order of notifier registration, affinity setting, and TPH (Transaction Layer Packet Processing Hints) programming to mitigate race conditions where TPH tags were updated before the notifier was properly initialized.\nThe vulnerability is present in versions of the Linux kernel utilizing the bnxt_en driver where the IRQ affinity handling logic retains the synchronous wait-while-locked dependency. The exposure is local, requiring either direct root access or the ability to manipulate network hardware configuration through privileged user-space tools."
}