CVE-2026-23041

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

bnxt_en: Fix NULL pointer crash in bnxt_ptp_enable during error cleanup

When bnxt_init_one() fails during initialization (e.g.,

bnxt_init_int_mode returns -ENODEV), the error path calls

bnxt_free_hwrm_resources() which destroys the DMA pool and sets

bp->hwrm_dma_pool to NULL. Subsequently, bnxt_ptp_clear() is called,

which invokes ptp_clock_unregister().

Since commit a60fc3294a37 ("ptp: rework ptp_clock_unregister() to

disable events"), ptp_clock_unregister() now calls

ptp_disable_all_events(), which in turn invokes the driver's .enable()

callback (bnxt_ptp_enable()) to disable PTP events before completing the

unregistration.

bnxt_ptp_enable() attempts to send HWRM commands via bnxt_ptp_cfg_pin()

and bnxt_ptp_cfg_event(), both of which call hwrm_req_init(). This

function tries to allocate from bp->hwrm_dma_pool, causing a NULL

pointer dereference:

bnxt_en 0000:01:00.0 (unnamed net_device) (uninitialized): bnxt_i

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References