CVE-2026-97572

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-97572", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-24T16:01:01.155Z", "datePublished": "2026-09-25T10:21:56.826Z", "dateUpdated": "2026-10-19T09:09:34.905Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-19T09:09:34.905Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbnxt_en: Propagate RX ring init failures in bnxt_init_nic()\n\nbnxt_init_rx_rings() returns an error when bnxt_alloc_one_rx_ring()\nfails, but bnxt_init_nic() discards that return value and calls\nbnxt_init_chip(), which enables TPA.\n\nIf an allocation fails, this could leave rxr->rx_tpa[] partially zeroed\nand TPA would be enabled over an array with zeroed entries. This would\nlead to a zeroed DMA address being handed out if the agg_idx is\ntranslated to a SW index at a zeroed entry.\n\nFix this by propagating the error out of bnxt_init_nic(). Both callers\nalready check its return value and unwind with bnxt_free_skbs() and\nbnxt_free_mem(), which tolerate a partially initialized RX ring."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/net/ethernet/broadcom/bnxt/bnxt.c"], "versions": [{"version": "c0c050c58d840994ba842ad1c338a98e7c12b764", "lessThan": "e40641638743b4b848d5ed78a0565afffc359d8e", "status": "affected", "versionType": "git"}, {"version": "c0c050c58d840994ba842ad1c338a98e7c12b764", "lessThan": "6b24eca42619b93f69aebc2aa0a9fd28ac9a5085", "status": "affected", "versionType": "git"}, {"version": "c0c050c58d840994ba842ad1c338a98e7c12b764", "lessThan": "1f2d333ae2e1a73b7cc1c2a627587024cd147c01", "status": "affected", "versionType": "git"}, {"version": "c0c050c58d840994ba842ad1c338a98e7c12b764", "lessThan": "c3eb07e78e628243cbb9bbb0115db802fb7a303f", "status": "affected", "versionType": "git"}, {"version": "c0c050c58d840994ba842ad1c338a98e7c12b764", "lessThan": "daadccd062fdca5e77a8cc22ffe35857803b6c49", "status": "affected", "versionType": "git"}, {"version": "c0c050c58d840994ba842ad1c338a98e7c12b764", "lessThan": "b4c40f2c80d7bf50648878bc206a39adfbfaec6c", "status": "affected", "versionType": "git"}, {"version": "c0c050c58d840994ba842ad1c338a98e7c12b764", "lessThan": "dfd73af81cdb9f7b399754a59e2658a08211bee5", "status": "affected", "versionType": "git"}, {"version": "c0c050c58d840994ba842ad1c338a98e7c12b764", "lessThan": "8e6a850c0746bb4be167aedf1ee57469fcda09a9", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/net/ethernet/broadcom/bnxt/bnxt.c"], "versions": [{"version": "4.4", "status": "affected"}, {"version": "0", "lessThan": "4.4", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.271", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.222", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.189", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.158", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.111", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.53", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.7", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.4", "versionEndExcluding": "5.10.271"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.4", "versionEndExcluding": "5.15.222"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.4", "versionEndExcluding": "6.1.189"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.4", "versionEndExcluding": "6.6.158"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.4", "versionEndExcluding": "6.12.111"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.4", "versionEndExcluding": "6.18.53"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.4", "versionEndExcluding": "7.2.7"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.4", "versionEndExcluding": "7.3"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/e40641638743b4b848d5ed78a0565afffc359d8e"}, {"url": "https://git.kernel.org/stable/c/6b24eca42619b93f69aebc2aa0a9fd28ac9a5085"}, {"url": "https://git.kernel.org/stable/c/1f2d333ae2e1a73b7cc1c2a627587024cd147c01"}, {"url": "https://git.kernel.org/stable/c/c3eb07e78e628243cbb9bbb0115db802fb7a303f"}, {"url": "https://git.kernel.org/stable/c/daadccd062fdca5e77a8cc22ffe35857803b6c49"}, {"url": "https://git.kernel.org/stable/c/b4c40f2c80d7bf50648878bc206a39adfbfaec6c"}, {"url": "https://git.kernel.org/stable/c/dfd73af81cdb9f7b399754a59e2658a08211bee5"}, {"url": "https://git.kernel.org/stable/c/8e6a850c0746bb4be167aedf1ee57469fcda09a9"}], "title": "bnxt_en: Propagate RX ring init failures in bnxt_init_nic()", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/net/ethernet/broadcom/bnxt/bnxt.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "e40641638743b4b848d5ed78a0565afffc359d8e", "status": "affected", "version": "c0c050c58d840994ba842ad1c338a98e7c12b764", "versionType": "git"}, {"lessThan": "6b24eca42619b93f69aebc2aa0a9fd28ac9a5085", "status": "affected", "version": "c0c050c58d840994ba842ad1c338a98e7c12b764", "versionType": "git"}, {"lessThan": "1f2d333ae2e1a73b7cc1c2a627587024cd147c01", "status": "affected", "version": "c0c050c58d840994ba842ad1c338a98e7c12b764", "versionType": "git"}, {"lessThan": "c3eb07e78e628243cbb9bbb0115db802fb7a303f", "status": "affected", "version": "c0c050c58d840994ba842ad1c338a98e7c12b764", "versionType": "git"}, {"lessThan": "daadccd062fdca5e77a8cc22ffe35857803b6c49", "status": "affected", "version": "c0c050c58d840994ba842ad1c338a98e7c12b764", "versionType": "git"}, {"lessThan": "b4c40f2c80d7bf50648878bc206a39adfbfaec6c", "status": "affected", "version": "c0c050c58d840994ba842ad1c338a98e7c12b764", "versionType": "git"}, {"lessThan": "dfd73af81cdb9f7b399754a59e2658a08211bee5", "status": "affected", "version": "c0c050c58d840994ba842ad1c338a98e7c12b764", "versionType": "git"}, {"lessThan": "8e6a850c0746bb4be167aedf1ee57469fcda09a9", "status": "affected", "version": "c0c050c58d840994ba842ad1c338a98e7c12b764", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/net/ethernet/broadcom/bnxt/bnxt.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "4.4"}, {"lessThan": "4.4", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.271", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.222", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.189", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.158", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.111", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.53", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.7", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbnxt_en: Propagate RX ring init failures in bnxt_init_nic()\n\nbnxt_init_rx_rings() returns an error when bnxt_alloc_one_rx_ring()\nfails, but bnxt_init_nic() discards that return value and calls\nbnxt_init_chip(), which enables TPA.\n\nIf an allocation fails, this could leave rxr->rx_tpa[] partially zeroed\nand TPA would be enabled over an array with zeroed entries. This would\nlead to a zeroed DMA address being handed out if the agg_idx is\ntranslated to a SW index at a zeroed entry.\n\nFix this by propagating the error out of bnxt_init_nic(). Both callers\nalready check its return value and unwind with bnxt_free_skbs() and\nbnxt_free_mem(), which tolerate a partially initialized RX ring."}], "id": "CVE-2026-97572", "lastModified": "2026-10-19T10:17:26.347", "metrics": {}, "published": "2026-09-25T11:17:07.910", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/1f2d333ae2e1a73b7cc1c2a627587024cd147c01"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/6b24eca42619b93f69aebc2aa0a9fd28ac9a5085"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/8e6a850c0746bb4be167aedf1ee57469fcda09a9"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/b4c40f2c80d7bf50648878bc206a39adfbfaec6c"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/c3eb07e78e628243cbb9bbb0115db802fb7a303f"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/daadccd062fdca5e77a8cc22ffe35857803b6c49"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/dfd73af81cdb9f7b399754a59e2658a08211bee5"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/e40641638743b4b848d5ed78a0565afffc359d8e"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: bnxt_en: Propagate RX ring init failures in bnxt_init_nic()", "id": "2541215", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2541215"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-252", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nbnxt_en: Propagate RX ring init failures in bnxt_init_nic()\nbnxt_init_rx_rings() returns an error when bnxt_alloc_one_rx_ring()\nfails, but bnxt_init_nic() discards that return value and calls\nbnxt_init_chip(), which enables TPA.\nIf an allocation fails, this could leave rxr->rx_tpa[] partially zeroed\nand TPA would be enabled over an array with zeroed entries. This would\nlead to a zeroed DMA address being handed out if the agg_idx is\ntranslated to a SW index at a zeroed entry.\nFix this by propagating the error out of bnxt_init_nic(). Both callers\nalready check its return value and unwind with bnxt_free_skbs() and\nbnxt_free_mem(), which tolerate a partially initialized RX ring.", "A flaw was found in the Linux kernel's Broadcom NetXtreme (bnxt_en) network driver. This flaw can result in a Denial of Service (DoS) or memory corruption when the device is initialized or reset under low-memory conditions. The driver ignores memory allocation errors during receive ring buffer setup and continues enabling packet processing over uninitialized memory structures. Consequently, subsequent network traffic can trigger invalid Direct Memory Access (DMA) operations using zeroed addresses, leading to kernel memory corruption and a system crash."], "name": "CVE-2026-97572", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Fix deferred", "package_name": "openshift/ose-rhel-coreos-8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Fix deferred", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-09-25T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-97572\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-97572\nhttps://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-97572.mbox"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[c0c050c58d840994ba842ad1c338a98e7c12b764,daadccd062fdca5e77a8cc22ffe35857803b6c49)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[c0c050c58d840994ba842ad1c338a98e7c12b764,b4c40f2c80d7bf50648878bc206a39adfbfaec6c)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[c0c050c58d840994ba842ad1c338a98e7c12b764,dfd73af81cdb9f7b399754a59e2658a08211bee5)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[c0c050c58d840994ba842ad1c338a98e7c12b764,8e6a850c0746bb4be167aedf1ee57469fcda09a9)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "4.4"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[0,4.4)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.111,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.53,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.2.7,7.3.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.3-rc3,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-09-25T18:15:15.772724+00:00", "updated": "2026-10-01T11:30:05.849153+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}