PT-2026-106685

In the Linux kernel, the following vulnerability has been resolved: RDMA/bnxt re: check create singlethread workqueue in DCB setup bnxt re init dcb wq ignores a failed allocation. The async DCB handler later calls queue work on the NULL pointer...

Rocky Linux 9 [CIQ] Security Update: kernel / kernel-64k / kernel-64k-core / kernel-64k-debug / etc Multiple Vulnerabilities (crlsa-2025_9080)

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20259080 advisory. kernel: eth: bnxt: fix truesize for mb-xdp-pass case CVE-2025-21961 kernel: Bluetooth: L2CAP: Fix slab-use-after-free Read in l2capsendcmd CVE-2025-21969...

AlmaLinux 9.2 [TuxCare] Security Update: bpftool / kernel / kernel-abi-stablelists / kernel-core / etc Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2024:1725293298)

The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2024:1725293298 advisory. - A NULL pointer dereference vulnerability was found in vmwgfx driver in drivers/gpu/vmxgfx/vmxgfxexecbuf.c in GPU component of Linu...

PT-2026-98510

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An out-of-bounds write issue exists in the bnxt en driver. The bnxt alloc agg idx function is designed to map firmware TPA IDs to software IDs used to index the rxr-rx tpa array. When th...

PT-2026-98514

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the bnxt en driver where the bnxt queue mem alloc function performs a shallow copy of the live RX ring into a clone. While some pointers are cleared, rx tpa and rx tpa...

PT-2026-98509

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the bnxt en driver where the queue can stop and fail to restart. This occurs when the driver receives a burst of packets and marks Buffer Descriptors BD with the NO CM...

PT-2026-98512

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the bnxt en driver where the bnxt init nic function fails to propagate error return values from bnxt init rx rings. When bnxt alloc one rx ring fails, the return value...

PT-2026-98511

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the bnxt en driver where the bnxt queue mem alloc function fails to propagate return values from bnxt alloc one tpa info data. When bnxt alloc one tpa info data return...

PT-2026-98513

In the Linux kernel, the following vulnerability has been resolved: bnxt en: Handle buffer allocation failure in bnxt rx ring reset bnxt rx ring reset frees the ring buffers and then reallocates them, ignoring the result. bnxt alloc one rx ring can fail in bnxt alloc one tpa info data, which...

PT-2026-97964

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the RDMA/bnxt re component where destroy callbacks zero the udata output after driver resources are torn down. If userspace access fails, uverbs preserves the uobject...

PT-2026-94449

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the bnxt en driver where the hwmon notify event function is called using the platform device as the first parameter instead of the required hardware monitoring device...

PT-2026-94803

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description In the RDMA bnxt re component, the bnxt re mmap function rejects VM WRITE flags for DBR PAGE and TOGGLE PAGE memory mappings. However, a read-only mapping may still retain the VM MAYWRIT...

SUSE CVE-2026-80998

In the Linux kernel, the following vulnerability has been resolved: net: bnxt: ring the doorbell when SW USO exits early When a burst of packets is handed down to the driver, the driver defers the doorbell to the end by setting txr-kickpending = 1. The normal TX path handles this, but the SW USO...

Astra Linux – Vulnerability in Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: RDMA/bnxtre: Prevents handling of any completions after the destruction of a QP Queue Pair. The hardware may generate completions indicating that the QP has been destroyed. The driver should not schedule any completion handlers f...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: bnxten: Adjusted the logging of firmware messages in case the token is released in hwrmsend. If the token is released because token-state equals BNXTHWRMDEFERRED, the released token set to NULL is used in log messages. This issue...

Astra Linux – Vulnerability in Linux 5.10, Linux

In the Linux kernel, the following vulnerability has been resolved: bnxten: Fixed a possible crash in bnxthwrmsetcoal During the error recovery sequence, the rtnllock is not held for the entire duration, and some data structures may be freed during this process. Instead of checking netifrunning,...

Astra Linux – Vulnerability in Linux 5.10, Linux, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: bnxten: Avoid order-5 memory allocation for TPA data. The driver needs to keep track of all possible concurrent TPA GRO/LRO completions on the aggregation ring. On P5 chips, the maximum number of concurrent TPA is 256, and the...

Astra Linux – Vulnerability in Linux

In the Linux kernel, the following vulnerability has been resolved: bnxten: Fixed the RX consumer index logic in the error path. In bnxtrxpkt, the RX buffers are expected to complete in order. If the RX consumer index indicates an out-of-order buffer completion, it means we are encountering a...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: bnxten: Correctly sets the DMA unmap len for XDPREDIRECT. When transmitting an XDPREDIRECT packet, call dmaunmaplenset with the correct length instead of 0. This bug triggers this warning on a system with IOMMU enabled: WARNIN...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: For the eth:bnxt device, features are always recalculated after the XDP configuration is cleared. This issue was fixed by handling the case where null-deref occurs. Features are recalculated when the XDP is detached. Before: bash...