CVE-2026-74697

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-74697", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-08-15T05:44:03.927Z", "datePublished": "2026-08-22T15:32:59.073Z", "dateUpdated": "2026-10-21T12:46:11.741Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-21T12:46:11.741Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbnxt_en: Disable EOP for TPA on all chips to prevent data corruption\n\nEOP (End of frame padding) on the AGG ring may cause overlapping of\nzero padding at the end of one segment with the next segment's data.\nIf Relaxed Ordering (RO) is enabled, the zero padding may overwrite\nvalid data in the next segment and corrupt the data. Older chips\n(P5 and older) do not automatically disable RO when EOP is enabled.\nOn some ARM systems, data corruption was reported on 57508 (P5)\nchips with RO enabled.\n\nAlways disable EOP on all chips on the AGG rings when TPA is enabled\nto fix the data corruption."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L", "baseScore": 8.2, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:N - The bug is in bnxt_en hardware RX/TPA aggregation on incoming packets; remote TCP traffic reaches bnxt_msix\u2192napi\u2192bnxt_rx_pkt\u2192bnxt_tpa_end without local syscalls, matching network-reachable net driver guidance for internet-facing cloud servers with Broadcom NICs.\nAC:L - An attacker controls TCP segment sizes, timing, and retry volume to drive TPA aggregation on default NETIF_F_GRO_HW interfaces; the fix documents reproducible corruption on 57508/P5 ARM hosts with PCIe Relaxed Ordering, the scored deployment scenario.\nPR:N - The vulnerable receive fast path performs no authentication or capability checks on incoming frames; any remote peer sending TCP traffic to a host with an affected P5-or-older bnxt_en NIC can trigger hardware TPA aggregation and AGG-ring DMA corruption.\nUI:N - Hardware GRO/TPA is enabled by default on bnxt_en netdevs; exploitation requires only normal network exposure and attacker-sent traffic, with no victim mount, file open, or administrative action.\nS:U - Impact is corrupted RX skb payload data processed within the host kernel and network stack; it does not cross VM, container-host, or IOMMU security boundaries into a separate authority.\nC:N - EOP zero-padding overwrites valid segment bytes with zeros in page-pool RX buffers; there is no out-of-bounds read, UAF, or kernel-memory disclosure\u2014only destruction of receive-buffer contents.\nI:H - Hardware DMA corruption of TPA aggregation buffers modifies delivered skb payload bytes before napi_gro_receive, enabling remote integrity corruption of TCP/application data processed by the kernel and upper-layer services on affected hosts.\nA:L - No kernel oops or panic is documented, but repeated remote triggering can persistently corrupt received payloads, provoking TCP/application errors and degrading availability of correct network processing on affected Broadcom P5 NICs."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/net/ethernet/broadcom/bnxt/bnxt.c"], "versions": [{"version": "bfcd8d791ec18496772d117774398e336917f56e", "lessThan": "68c181af7cd1ca9cbf29acd95911073bfd3c6397", "status": "affected", "versionType": "git"}, {"version": "bfcd8d791ec18496772d117774398e336917f56e", "lessThan": "7aee22a35978b44784612c156e358e375ddf5d16", "status": "affected", "versionType": "git"}, {"version": "bfcd8d791ec18496772d117774398e336917f56e", "lessThan": "410da4428b1f47bf9a84bdc0bcaa089d73ba2048", "status": "affected", "versionType": "git"}, {"version": "bfcd8d791ec18496772d117774398e336917f56e", "lessThan": "b61c4911204a0a2f900e538d64ceb608f6c9614d", "status": "affected", "versionType": "git"}, {"version": "bfcd8d791ec18496772d117774398e336917f56e", "lessThan": "927e2617a36f49752cb5613900ca21f40593f07d", "status": "affected", "versionType": "git"}, {"version": "bfcd8d791ec18496772d117774398e336917f56e", "lessThan": "aab3b5f4d8ec8598606ee011e219ef824ae25ca0", "status": "affected", "versionType": "git"}, {"version": "bfcd8d791ec18496772d117774398e336917f56e", "lessThan": "c1962ab4645a914a91ff492735881150ddc8a79e", "status": "affected", "versionType": "git"}, {"version": "bfcd8d791ec18496772d117774398e336917f56e", "lessThan": "c3faf548a00f4c17100cc9204746975fa46a73b9", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/net/ethernet/broadcom/bnxt/bnxt.c"], "versions": [{"version": "5.4", "status": "affected"}, {"version": "0", "lessThan": "5.4", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.265", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.216", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.183", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.152", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.114", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.45", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.1.9", "lessThanOrEqual": "7.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.4", "versionEndExcluding": "5.10.265"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.4", "versionEndExcluding": "5.15.216"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.4", "versionEndExcluding": "6.1.183"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.4", "versionEndExcluding": "6.6.152"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.4", "versionEndExcluding": "6.12.114"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.4", "versionEndExcluding": "6.18.45"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.4", "versionEndExcluding": "7.1.9"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.4", "versionEndExcluding": "7.2"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/68c181af7cd1ca9cbf29acd95911073bfd3c6397"}, {"url": "https://git.kernel.org/stable/c/7aee22a35978b44784612c156e358e375ddf5d16"}, {"url": "https://git.kernel.org/stable/c/410da4428b1f47bf9a84bdc0bcaa089d73ba2048"}, {"url": "https://git.kernel.org/stable/c/b61c4911204a0a2f900e538d64ceb608f6c9614d"}, {"url": "https://git.kernel.org/stable/c/927e2617a36f49752cb5613900ca21f40593f07d"}, {"url": "https://git.kernel.org/stable/c/aab3b5f4d8ec8598606ee011e219ef824ae25ca0"}, {"url": "https://git.kernel.org/stable/c/c1962ab4645a914a91ff492735881150ddc8a79e"}, {"url": "https://git.kernel.org/stable/c/c3faf548a00f4c17100cc9204746975fa46a73b9"}], "title": "bnxt_en: Disable EOP for TPA on all chips to prevent data corruption", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-74697", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-16T19:14:48.095926Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-16T19:16:09.972Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-74697", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-16T19:14:48.095926Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-16T19:14:49.051Z"}}], "cna": {"title": "bnxt_en: Disable EOP for TPA on all chips to prevent data corruption", "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 8.2, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L"}, "scenarios": [{"lang": "en", "value": "AV:N - The bug is in bnxt_en hardware RX/TPA aggregation on incoming packets; remote TCP traffic reaches bnxt_msix\u2192napi\u2192bnxt_rx_pkt\u2192bnxt_tpa_end without local syscalls, matching network-reachable net driver guidance for internet-facing cloud servers with Broadcom NICs.\nAC:L - An attacker controls TCP segment sizes, timing, and retry volume to drive TPA aggregation on default NETIF_F_GRO_HW interfaces; the fix documents reproducible corruption on 57508/P5 ARM hosts with PCIe Relaxed Ordering, the scored deployment scenario.\nPR:N - The vulnerable receive fast path performs no authentication or capability checks on incoming frames; any remote peer sending TCP traffic to a host with an affected P5-or-older bnxt_en NIC can trigger hardware TPA aggregation and AGG-ring DMA corruption.\nUI:N - Hardware GRO/TPA is enabled by default on bnxt_en netdevs; exploitation requires only normal network exposure and attacker-sent traffic, with no victim mount, file open, or administrative action.\nS:U - Impact is corrupted RX skb payload data processed within the host kernel and network stack; it does not cross VM, container-host, or IOMMU security boundaries into a separate authority.\nC:N - EOP zero-padding overwrites valid segment bytes with zeros in page-pool RX buffers; there is no out-of-bounds read, UAF, or kernel-memory disclosure\u2014only destruction of receive-buffer contents.\nI:H - Hardware DMA corruption of TPA aggregation buffers modifies delivered skb payload bytes before napi_gro_receive, enabling remote integrity corruption of TCP/application data processed by the kernel and upper-layer services on affected hosts.\nA:L - No kernel oops or panic is documented, but repeated remote triggering can persistently corrupt received payloads, provoking TCP/application errors and degrading availability of correct network processing on affected Broadcom P5 NICs."}]}], "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "bfcd8d791ec18496772d117774398e336917f56e", "lessThan": "68c181af7cd1ca9cbf29acd95911073bfd3c6397", "versionType": "git"}, {"status": "affected", "version": "bfcd8d791ec18496772d117774398e336917f56e", "lessThan": "7aee22a35978b44784612c156e358e375ddf5d16", "versionType": "git"}, {"status": "affected", "version": "bfcd8d791ec18496772d117774398e336917f56e", "lessThan": "410da4428b1f47bf9a84bdc0bcaa089d73ba2048", "versionType": "git"}, {"status": "affected", "version": "bfcd8d791ec18496772d117774398e336917f56e", "lessThan": "b61c4911204a0a2f900e538d64ceb608f6c9614d", "versionType": "git"}, {"status": "affected", "version": "bfcd8d791ec18496772d117774398e336917f56e", "lessThan": "927e2617a36f49752cb5613900ca21f40593f07d", "versionType": "git"}, {"status": "affected", "version": "bfcd8d791ec18496772d117774398e336917f56e", "lessThan": "aab3b5f4d8ec8598606ee011e219ef824ae25ca0", "versionType": "git"}, {"status": "affected", "version": "bfcd8d791ec18496772d117774398e336917f56e", "lessThan": "c1962ab4645a914a91ff492735881150ddc8a79e", "versionType": "git"}, {"status": "affected", "version": "bfcd8d791ec18496772d117774398e336917f56e", "lessThan": "c3faf548a00f4c17100cc9204746975fa46a73b9", "versionType": "git"}], "programFiles": ["drivers/net/ethernet/broadcom/bnxt/bnxt.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "5.4"}, {"status": "unaffected", "version": "0", "lessThan": "5.4", "versionType": "semver"}, {"status": "unaffected", "version": "5.10.265", "versionType": "semver", "lessThanOrEqual": "5.10.*"}, {"status": "unaffected", "version": "5.15.216", "versionType": "semver", "lessThanOrEqual": "5.15.*"}, {"status": "unaffected", "version": "6.1.183", "versionType": "semver", "lessThanOrEqual": "6.1.*"}, {"status": "unaffected", "version": "6.6.152", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.12.114", "versionType": "semver", "lessThanOrEqual": "6.12.*"}, {"status": "unaffected", "version": "6.18.45", "versionType": "semver", "lessThanOrEqual": "6.18.*"}, {"status": "unaffected", "version": "7.1.9", "versionType": "semver", "lessThanOrEqual": "7.1.*"}, {"status": "unaffected", "version": "7.2", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["drivers/net/ethernet/broadcom/bnxt/bnxt.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/68c181af7cd1ca9cbf29acd95911073bfd3c6397"}, {"url": "https://git.kernel.org/stable/c/7aee22a35978b44784612c156e358e375ddf5d16"}, {"url": "https://git.kernel.org/stable/c/410da4428b1f47bf9a84bdc0bcaa089d73ba2048"}, {"url": "https://git.kernel.org/stable/c/b61c4911204a0a2f900e538d64ceb608f6c9614d"}, {"url": "https://git.kernel.org/stable/c/927e2617a36f49752cb5613900ca21f40593f07d"}, {"url": "https://git.kernel.org/stable/c/aab3b5f4d8ec8598606ee011e219ef824ae25ca0"}, {"url": "https://git.kernel.org/stable/c/c1962ab4645a914a91ff492735881150ddc8a79e"}, {"url": "https://git.kernel.org/stable/c/c3faf548a00f4c17100cc9204746975fa46a73b9"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbnxt_en: Disable EOP for TPA on all chips to prevent data corruption\n\nEOP (End of frame padding) on the AGG ring may cause overlapping of\nzero padding at the end of one segment with the next segment's data.\nIf Relaxed Ordering (RO) is enabled, the zero padding may overwrite\nvalid data in the next segment and corrupt the data. Older chips\n(P5 and older) do not automatically disable RO when EOP is enabled.\nOn some ARM systems, data corruption was reported on 57508 (P5)\nchips with RO enabled.\n\nAlways disable EOP on all chips on the AGG rings when TPA is enabled\nto fix the data corruption."}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.10.265", "versionStartIncluding": "5.4"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.15.216", "versionStartIncluding": "5.4"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.1.183", "versionStartIncluding": "5.4"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.6.152", "versionStartIncluding": "5.4"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.12.114", "versionStartIncluding": "5.4"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.18.45", "versionStartIncluding": "5.4"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "7.1.9", "versionStartIncluding": "5.4"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "7.2", "versionStartIncluding": "5.4"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-21T12:46:11.741Z"}}}, "cveMetadata": {"cveId": "CVE-2026-74697", "state": "PUBLISHED", "dateUpdated": "2026-10-21T12:46:11.741Z", "dateReserved": "2026-08-15T05:44:03.927Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2026-08-22T15:32:59.073Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/net/ethernet/broadcom/bnxt/bnxt.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "68c181af7cd1ca9cbf29acd95911073bfd3c6397", "status": "affected", "version": "bfcd8d791ec18496772d117774398e336917f56e", "versionType": "git"}, {"lessThan": "7aee22a35978b44784612c156e358e375ddf5d16", "status": "affected", "version": "bfcd8d791ec18496772d117774398e336917f56e", "versionType": "git"}, {"lessThan": "410da4428b1f47bf9a84bdc0bcaa089d73ba2048", "status": "affected", "version": "bfcd8d791ec18496772d117774398e336917f56e", "versionType": "git"}, {"lessThan": "b61c4911204a0a2f900e538d64ceb608f6c9614d", "status": "affected", "version": "bfcd8d791ec18496772d117774398e336917f56e", "versionType": "git"}, {"lessThan": "927e2617a36f49752cb5613900ca21f40593f07d", "status": "affected", "version": "bfcd8d791ec18496772d117774398e336917f56e", "versionType": "git"}, {"lessThan": "aab3b5f4d8ec8598606ee011e219ef824ae25ca0", "status": "affected", "version": "bfcd8d791ec18496772d117774398e336917f56e", "versionType": "git"}, {"lessThan": "c1962ab4645a914a91ff492735881150ddc8a79e", "status": "affected", "version": "bfcd8d791ec18496772d117774398e336917f56e", "versionType": "git"}, {"lessThan": "c3faf548a00f4c17100cc9204746975fa46a73b9", "status": "affected", "version": "bfcd8d791ec18496772d117774398e336917f56e", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/net/ethernet/broadcom/bnxt/bnxt.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "5.4"}, {"lessThan": "5.4", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.265", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.216", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.183", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.152", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.114", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.45", "versionType": "semver"}, {"lessThanOrEqual": "7.1.*", "status": "unaffected", "version": "7.1.9", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.2", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbnxt_en: Disable EOP for TPA on all chips to prevent data corruption\n\nEOP (End of frame padding) on the AGG ring may cause overlapping of\nzero padding at the end of one segment with the next segment's data.\nIf Relaxed Ordering (RO) is enabled, the zero padding may overwrite\nvalid data in the next segment and corrupt the data. Older chips\n(P5 and older) do not automatically disable RO when EOP is enabled.\nOn some ARM systems, data corruption was reported on 57508 (P5)\nchips with RO enabled.\n\nAlways disable EOP on all chips on the AGG rings when TPA is enabled\nto fix the data corruption."}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nbnxt_en: Deshabilitar EOP para TPA en todos los chips para prevenir la corrupci\u00f3n de datos\n\nEOP (relleno de fin de trama) en el anillo AGG puede causar la superposici\u00f3n de relleno de ceros al final de un segmento con los datos del siguiente segmento. Si Relaxed Ordering (RO) est\u00e1 habilitado, el relleno de ceros puede sobrescribir datos v\u00e1lidos en el siguiente segmento y corromper los datos. Chips m\u00e1s antiguos (P5 y anteriores) no deshabilitan autom\u00e1ticamente RO cuando EOP est\u00e1 habilitado. En algunos sistemas ARM, se inform\u00f3 de corrupci\u00f3n de datos en chips 57508 (P5) con RO habilitado.\n\nDeshabilitar siempre EOP en todos los chips en los anillos AGG cuando TPA est\u00e1 habilitado para corregir la corrupci\u00f3n de datos."}], "id": "CVE-2026-74697", "lastModified": "2026-10-21T13:19:49.140", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 8.2, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 4.2, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-74697", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-10-16T19:14:48.095926Z", "version": "2.0.3"}}]}, "published": "2026-08-22T16:16:44.280", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/410da4428b1f47bf9a84bdc0bcaa089d73ba2048"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/68c181af7cd1ca9cbf29acd95911073bfd3c6397"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/7aee22a35978b44784612c156e358e375ddf5d16"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/927e2617a36f49752cb5613900ca21f40593f07d"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/aab3b5f4d8ec8598606ee011e219ef824ae25ca0"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/b61c4911204a0a2f900e538d64ceb608f6c9614d"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/c1962ab4645a914a91ff492735881150ddc8a79e"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/c3faf548a00f4c17100cc9204746975fa46a73b9"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: bnxt_en: Disable EOP for TPA on all chips to prevent data corruption", "id": "2521478", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2521478"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.0", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-805", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nbnxt_en: Disable EOP for TPA on all chips to prevent data corruption\nEOP (End of frame padding) on the AGG ring may cause overlapping of\nzero padding at the end of one segment with the next segment's data.\nIf Relaxed Ordering (RO) is enabled, the zero padding may overwrite\nvalid data in the next segment and corrupt the data. Older chips\n(P5 and older) do not automatically disable RO when EOP is enabled.\nOn some ARM systems, data corruption was reported on 57508 (P5)\nchips with RO enabled.\nAlways disable EOP on all chips on the AGG rings when TPA is enabled\nto fix the data corruption.", "A flaw was found in the Linux kernel's bnxt_en driver. This vulnerability occurs when End of frame padding (EOP) on the AGG ring overlaps with subsequent data segments. On older network chips, if Relaxed Ordering (RO) is active, this overlap can cause valid data to be overwritten with zeros. This can lead to data corruption, impacting the integrity of information processed by the system."], "name": "CVE-2026-74697", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-08-22T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-74697\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-74697\nhttps://lore.kernel.org/linux-cve-announce/2026082235-CVE-2026-74697-aa0a@gregkh/T"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[bfcd8d791ec18496772d117774398e336917f56e,68c181af7cd1ca9cbf29acd95911073bfd3c6397)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[bfcd8d791ec18496772d117774398e336917f56e,7aee22a35978b44784612c156e358e375ddf5d16)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[bfcd8d791ec18496772d117774398e336917f56e,410da4428b1f47bf9a84bdc0bcaa089d73ba2048)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[bfcd8d791ec18496772d117774398e336917f56e,b61c4911204a0a2f900e538d64ceb608f6c9614d)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[bfcd8d791ec18496772d117774398e336917f56e,aab3b5f4d8ec8598606ee011e219ef824ae25ca0)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[bfcd8d791ec18496772d117774398e336917f56e,c1962ab4645a914a91ff492735881150ddc8a79e)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[bfcd8d791ec18496772d117774398e336917f56e,c3faf548a00f4c17100cc9204746975fa46a73b9)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "5.4"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[0,5.4)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[5.10.265,5.11.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[5.15.216,5.16.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.1.183,6.2.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.6.152,6.7.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.45,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.1.9,7.2.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.2,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-08-22T17:30:02.930758+00:00", "updated": "2026-08-25T15:30:05.655288+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}