CVE-2026-97572

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

bnxt_en: Propagate RX ring init failures in bnxt_init_nic()

bnxt_init_rx_rings() returns an error when bnxt_alloc_one_rx_ring()

fails, but bnxt_init_nic() discards that return value and calls

bnxt_init_chip(), which enables TPA.

If an allocation fails, this could leave rxr->rx_tpa[] partially zeroed

and TPA would be enabled over an array with zeroed entries. This would

lead to a zeroed DMA address being handed out if the agg_idx is

translated to a SW index at a zeroed entry.

Fix this by propagating the error out of bnxt_init_nic(). Both callers

already check its return value and unwind with bnxt_free_skbs() and

bnxt_free_mem(), which tolerate a partially initialized RX ring.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References