Skip to main content

Linux Kernel CVE-2026-53177

| EUVDEUVD-2026-39268 MEDIUM
NULL Pointer Dereference (CWE-476)
2026-06-25 416baaa9-dc9f-4396-8d5f-8c081fb06d67 GHSA-fgqh-527q-6hx4
Denial Of Service Linux Null Pointer Dereference Red Hat Suse
5.5
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
vuln.today AI
4.7 MEDIUM

AC:H over NVD's AC:L because two independent conditions (NIC closed and PCIe error concurrent) must align; all other metrics match the description and NVD vector.

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
4.0 AV:L/AC:H/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
4.7 MEDIUM
AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
Red Hat
5.5 LOW
qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

5
Analysis Generated
Jul 06, 2026 - 18:35 vuln.today
CVSS changed
Jul 06, 2026 - 18:22 NVD
5.5 (MEDIUM)
Patch available
Jun 25, 2026 - 10:32 EUVD
CVE Published
Jun 25, 2026 - 09:16 nvd
MEDIUM 5.5
CVE Published
Jun 25, 2026 - 09:16 cve.org
UNKNOWN (no severity yet)

DescriptionNVD

In the Linux kernel, the following vulnerability has been resolved:

bnxt_en: Fix NULL pointer dereference

PCIe errors detected by a Root Port or Downstream Port cause error recovery services to run on all subordinate devices regardless of administrative state.

The .error_detected() callback, bnxt_io_error_detected(), disables and synchronizes IRQs via bnxt_disable_int_sync(), which calls bnxt_cp_num_to_irq_num() to map completion rings to IRQs using bp->bnapi.

Since bp->bnapi is allocated on NIC open and freed on NIC close, PCIe error recovery on a closed NIC can dereference a NULL pointer.

Check if bp->bnapi is NULL before disabling and synchronizing IRQs.

AnalysisAI

NULL pointer dereference in the Linux kernel bnxt_en Broadcom NetXtreme Ethernet driver crashes the kernel when PCIe error recovery fires against a closed NIC, causing a denial of service. Affected kernel versions span from 4.17 through multiple LTS and mainline branches up to 7.1-rc4, with patches released across all active stable series. No public exploit exists and EPSS sits at 0.17% (7th percentile), marking this as a reliability and stability concern rather than an actively targeted attack vector.

Technical ContextAI

The bnxt_en driver implements the PCIe Advanced Error Reporting (AER) recovery interface via the .error_detected() callback bnxt_io_error_detected(). When a Root Port or Downstream Port detects a PCIe fault, the kernel AER subsystem invokes recovery callbacks on all subordinate devices regardless of their administrative state. The callback calls bnxt_disable_int_sync(), which in turn invokes bnxt_cp_num_to_irq_num() to map completion rings to IRQ numbers using bp->bnapi - the per-ring NAPI structure. CWE-476 (NULL Pointer Dereference) applies because bp->bnapi is allocated during NIC open (ip link set up / ifconfig up) and freed during NIC close. If AER recovery triggers while the NIC is closed, bp->bnapi is NULL and the dereference causes a kernel panic. The fix, present in commits across stable branches at git.kernel.org/stable, adds a NULL guard on bp->bnapi before the IRQ disable/sync path. Affected CPE: cpe:2.3:o:linux:linux_kernel with introduction at commit e5811b8c09df9bc80eabc95339fceded23f16289 (Linux 4.17).

RemediationAI

Upgrade to a patched kernel version appropriate to the deployed stable branch: 5.15.210+ for 5.15.x LTS, 6.1.176+ for 6.1.x LTS, 6.6.143+ for 6.6.x LTS, 6.12.94+ for 6.12.x LTS, 6.18.36+ for 6.18.x, 7.0.13+ for 7.0.x, or 7.1 stable for mainline. Individual fix commits are available at git.kernel.org/stable (see references: 08e57d01, 1a418ad0, 3884976f, 580844a9, 59c5a3e6, 964b1c3e, d930276f, 1449177b). Kernel live-patching solutions such as kpatch or kGraft may allow applying the fix without a reboot on supported distributions. As a compensating control, systems that do not install Broadcom NetXtreme adapters or do not load the bnxt_en module are not affected and can suppress the module via /etc/modprobe.d to eliminate exposure. Keeping bnxt NICs administratively up at all times removes the NULL bp->bnapi condition but is not a robust mitigation since PCIe errors can still cause the recovery path to run. ENISA EUVD advisory: EUVD-2026-39268.

Same weakness CWE-476 – NULL Pointer Dereference

View all
CVE-2016-0742 HIGH
7.5
CVE-2014-3470 MEDIUM
4.3
CVE-2017-3730 HIGH POC
7.5
CVE-2017-3169 CRITICAL POC
9.8
CVE-2016-4957 HIGH
7.5
CVE-2015-3194 HIGH
7.5
CVE-2026-21525 MEDIUM
6.2
CVE-2017-0016 MEDIUM
5.9

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Not-Affected

Share

CVE-2026-53177 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy