Description

In the Linux kernel, the following vulnerability has been resolved: bnxt_en: Bound SW TPA IDs to prevent crashes FW supports up to 1024 concurrent TPAs, so the FW TPA ID is in the range 0..1023 (see commit ec4d8e7cf024 ("bnxt_en: Add TPA ID mapping logic for 57500 chips.")). bnxt_alloc_agg_idx is intended to wrap the FW ID down to a software ID which is used to index rxr->rx_tpa, and to generate a mapping between FW IDs and the wrapped software ID. On a 57608 with firmware version 233, the firmware advertises 32 concurrent TPAs. As of the commit under fixes, bp->max_tpa on this NIC is set to 32. If the software ID from bnxt_alloc_agg_idx is above 31, this results in an invalid address being loaded on this line: tpa_info = &rxr->rx_tpa[agg_id]; because rx_tpa is allocated with only bp->max_tpa (32) entries. Writes to tpa_info later in the code are out of bounds. This bug results in a crash at boot: Oops: general protection fault, kernel NULL pointer dereference 0x8: 0000 [#1] SMP NOPTI RIP: 0010:bnxt_rx_pkt+0xc0/0x1560 RSP: 0018:ffffc900009b8c78 EFLAGS: 00010246 RAX: 0000000000000000 RBX: 0000000000000048 RCX: 0000000206682516 RDX: ffffc900009b8db4 RSI: 0000000000000000 RDI: 01ffffff038fe1c0 RBP: ffffc9006e687480 R08: ffffc9006e687000 R09: 0000000000003048 R10: 0000000000000480 R11: ffff8881c6083900 R12: 0000000006682516 R13: ffff8881c6095400 R14: 0000000000000016 R15: ffff8881c6b66680 FS: 0000000000000000(0000) GS:ffff88fef3c77000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007fc8bda40584 CR3: 000000807c812001 CR4: 0000000008772ef0 PKRU: 55555554 Call Trace: <IRQ> ? __netif_receive_skb_list_core+0x1ca/0x250 __bnxt_poll_work+0x152/0x280 bnxt_poll_p5+0x1cd/0x480 __napi_poll+0x30/0x180 net_rx_action+0x20b/0x3b0 ? note_gp_changes+0x53/0xe0 ? tick_setup_sched_timer+0x180/0x180 ? __napi_schedule+0x9a/0xb0 ? bnxt_msix+0x24/0x30 handle_softirqs+0xdd/0x2c0 __irq_exit_rcu.llvm.3171231171502365008+0x47/0xf0 common_interrupt+0x85/0x90 </IRQ> <TASK> asm_common_interrupt+0x22/0x40 This stack trace is from a crash triggered when an out of bounds rx_tpa is dereferenced. The invalid write mentioned above is silent in this particular crash. Fix this by allocating rx_tpa with bp->max_tpa rounded up to the next power of 2 (bp->max_tpa_roundup_size) entries and masking the FW TPA ID with that size, so the wrapped ID can never index past the end of the array.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.1",
  "pubDate": "2026-09-25T11:17:07.683Z",
  "pubdate": "2026-09-25T11:17:07.683Z",
  "executiveSummary": "The bnxt_en Linux kernel driver is susceptible to an out-of-bounds (OOB) memory access vulnerability during the processing of firmware-assisted TCP Offload (TPA) packets.\nThe vulnerability stems from an insufficient boundary check between firmware-provided TPA identifiers and the software-allocated rx_tpa array.\nWhen the firmware advertises a number of concurrent TPAs that does not align with the allocated software index, the mapping logic produces indices that exceed the array size.\nThis leads to memory corruption through unauthorized writes to adjacent kernel memory or system crashes via a general protection fault.\nThe issue impacts systems utilizing the Broadcom NetXtreme-E series network controllers (e.g., 57608).\nExploitation requires the device to be active and processing incoming network traffic; a successful attack can result in immediate system instability or potential arbitrary kernel data modification, representing a high-severity local availability risk.",
  "technicalDetails": "The root cause of this vulnerability lies in the improper mapping of hardware-provided TPA IDs to the software-side rx_tpa array indexing logic within the bnxt_en driver. The firmware (FW) supports a large range of TPA IDs (0-1023), which must be wrapped into a smaller software ID range for indexing into the driver's rx_tpa structure.\nThe rx_tpa structure is allocated based on the value of bp->max_tpa. On specific hardware, such as the 57608 chipset with firmware version 233, the firmware reports support for 32 concurrent TPAs. Consequently, the driver allocates 32 entries for rx_tpa. However, the calculation performed by bnxt_alloc_agg_idx occasionally generates a software ID greater than 31, despite the underlying hardware configuration.\nWhen a network packet arrives and the driver attempts to access the TPA information via the code path 'tpa_info = &rxr->rx_tpa[agg_id];', the invalid 'agg_id' causes a pointer dereference outside the legitimate bounds of the 'rx_tpa' array. This results in the driver performing out-of-bounds reads and writes in the kernel's memory space.\nThe attack flow is triggered by the reception of specialized network traffic that causes the NIC firmware to initiate TPA aggregation. Because the driver trustfully uses the index generated by the faulty mapping logic, an attacker can influence the state of the RX ring buffer. The lack of bounds checking on the resulting index allows the system to read or write to memory offsets that do not belong to the intended rx_tpa objects.\nThe observed impact manifests as a general protection fault or a kernel NULL pointer dereference, as evidenced by the kernel panic logs. This indicates that the corrupted memory access disrupts kernel operation, likely overwriting critical data structures adjacent to the rx_tpa array. Post-exploitation, the immediate outcome is a complete denial-of-service (system crash). Furthermore, because the error involves OOB writes, if the memory layout allows, it could theoretically be weaponized to modify kernel control flows, although the primary symptom is kernel instability."
}