Vulnerability in Linux

[ Description ]Official description

In the Linux kernel, the following vulnerability has been resolved: bnxt_en: Don't free the live ring's TPA state on queue restart failure bnxt_queue_mem_alloc() shallow copies the live RX ring into the clone: memcpy(clone, rxr, sizeof(*rxr)); the code currently clears pointers that the clone owns (such as rx_agg_bmap), but rx_tpa and rx_tpa_idx_map are left pointing at memory of the live ring that was cloned. If an allocation failure happens later and the err_free_tpa_info label is taken, the live ring's memory can be freed while still in use. Fix this by initializing the clone's pointers to NULL to prevent live ring state from being freed inadvertently.

[ Fixes ]Fixes and patches

No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.

[ Advisories ]Government CERT advisories

• BSI CERT-Bund24 Sep 2026WID-SEC-2026-3579

  Linux Kernel: Multiple vulnerabilities Translated from German

  CVE-2026-97615CVE-2026-97978CVE-2026-98127+590 more CVEs

[ References ]References

• git.kernel.org/stable/c/0596a7caa6fc283e142716739099c038d8714082
• git.kernel.org/stable/c/5ce7f36c334d723954855ac769ede2fe0e8f89c8
• git.kernel.org/stable/c/8ade95619cbfd1fc57f0f1a9a5ebdca2345a8d27
• git.kernel.org/stable/c/e42287b4d38d653f7d4a47f6c29b0c01288bb050