EUVD-2026-76321
GHSA-853c-vx6w-q6cv
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
TX-path driver bug requires local traffic generation through bnxt NIC with SW USO active under burst conditions; no remote unauthenticated trigger path exists.
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
Lifecycle Timeline
6DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
net: bnxt: ring the doorbell when SW USO exits early
When a burst of packets is handed down to the driver, the driver defers the doorbell to the end by setting txr->kick_pending = 1. The normal TX path handles this, but the SW USO path can miss it if it returns early.
If bnxt_sw_udp_gso_xmit runs but returns early with NETDEV_TX_BUSY and txr->kick_pending was previously set to 1, then the TX queue can stall because the driver wrote some BDs but never wrote the doorbell. The device won't know to do the TX which would generate the completion that would wake the queue back up.
Simplify bnxt_sw_udp_gso_xmit to set txr->kick_pending in its success case and check the flag on return. The added check after bnxt_sw_udp_gso_xmit returns ensures that any pending doorbells are written handling both successful USO and any early returns, which prevents the TX queue stall mentioned above.
This TX queue stall was observed on a production system with a netdev TX watchdog informing about the queue stall.
AnalysisAI
TX queue stall in the Linux kernel's Broadcom bnxt network driver causes network transmission to halt on systems running software UDP Segmentation Offload (SW USO). Under burst traffic conditions, the bnxt_sw_udp_gso_xmit function can return early with NETDEV_TX_BUSY while leaving txr->kick_pending set to 1, meaning the driver has written Buffer Descriptors (BDs) but never rings the device doorbell - so the NIC never processes the queued packets and the completion event that would wake the TX queue never arrives. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the following specific conditions: (1) the target system must have a Broadcom NetXtreme-C or NetXtreme-E NIC with the bnxt_en Linux kernel driver loaded; (2) software UDP Segmentation Offload (SW USO) must be active on the interface - this is typically enabled when the kernel handles UDP segmentation in software rather than offloading to hardware; (3) a burst of outbound UDP packets must be processed such that `txr->kick_pending` has already been set to 1 by one packet in the burst, and then the subsequent `bnxt_sw_udp_gso_xmit` call returns early with NETDEV_TX_BUSY due to ring buffer pressure. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The provided CVSS vector of AV:N/AC:L/PR:N/UI:N appears overstated for what is fundamentally a kernel driver state machine deficiency in the TX (outbound) path. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Update the Linux kernel to version 7.2.4 (stable) or 7.3-rc1 (mainline), which contain the fix. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all systems using the Broadcom bnxt network driver with Software UDP Segmentation Offload (SW USO) enabled and determine current kernel versions to assess production exposure to network transmission stalls. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Share
External POC / Exploit Code
Leaving vuln.today