Strix
64.7K

CVE-2026-97574

Unknown

Last modified

CVE-2026-97574 is a vulnerability of currently unknown severity. In the Linux kernel, the following vulnerability has been resolved: bnxt_en: Don't free the live ring's TPA state on queue restart failure bnxt_queue_mem_alloc() shallow copies the live RX ring into the clone: memcpy(clone, rxr, sizeof(*rxr)); the code currently clears pointers that the clone owns (such as rx_agg_bmap), but rx_tpa and rx_tpa_idx_map are left pointing at memory of the live ring that was cloned. If an allocation failure happens later and the err_free_tpa_info label is taken, the live ring's memory can be freed while still in use. Fix this by initializing the clone's pointers to NULL to prevent live ring state from being freed inadvertently..

Description

In the Linux kernel, the following vulnerability has been resolved: bnxt_en: Don't free the live ring's TPA state on queue restart failure bnxt_queue_mem_alloc() shallow copies the live RX ring into the clone: memcpy(clone, rxr, sizeof(*rxr)); the code currently clears pointers that the clone owns (such as rx_agg_bmap), but rx_tpa and rx_tpa_idx_map are left pointing at memory of the live ring that was cloned. If an allocation failure happens later and the err_free_tpa_info label is taken, the live ring's memory can be freed while still in use. Fix this by initializing the clone's pointers to NULL to prevent live ring state from being freed inadvertently.

Affected Software

Source: CNA advisory (CVE.org). NVD analysis pending.

VendorProductVersions
LinuxLinux>= bd649c5cc958169b8a8a3e77ea926d92d472b02a, < 8ade95619cbfd1fc57f0f1a9a5ebdca2345a8d27; >= bd649c5cc958169b8a8a3e77ea926d92d472b02a, < 0596a7caa6fc283e142716739099c038d8714082; >= bd649c5cc958169b8a8a3e77ea926d92d472b02a, < 5ce7f36c334d723954855ac769ede2fe0e8f89c8; 0997443906b96a051011f220a61e6dce4602ec54; >= 6.12.20, < 6.13
LinuxLinux6.13

References

Timeline

Published
Last Modified
Status
Received

Frequently Asked Questions

What is CVE-2026-97574?
In the Linux kernel, the following vulnerability has been resolved: bnxt_en: Don't free the live ring's TPA state on queue restart failure bnxt_queue_mem_alloc() shallow copies the live RX ring into the clone: memcpy(clone, rxr, sizeof(*rxr)); the code currently clears pointers that the clone owns (such as rx_agg_bmap), but rx_tpa and rx_tpa_idx_map are left pointing at memory of the live ring that was cloned. If an allocation failure happens later and the err_free_tpa_info label is taken, the live ring's memory can be freed while still in use. Fix this by initializing the clone's pointers to NULL to prevent live ring state from being freed inadvertently.
How severe is CVE-2026-97574?
Severity scoring for CVE-2026-97574 is pending analysis.
How do I fix CVE-2026-97574?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

How Strix Helps

Related CVEs from 2026

View all 2026CVEs →

Are you affected by CVE-2026-97574?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST