Linux Kernel CVE-2026-97573

Requires the Broadcom bnxt_en driver bound to a NetXtreme-C/E NIC with TPA (transparent/large receive aggregation) active, plus a kernel memory-allocation failure (-ENOMEM in bnxt_alloc_one_tpa_info_data) occurring precisely during an RX ring reset. Exploitation is limited by being non-attacker-controlled: it depends on host memory exhaustion coinciding with a ring reset event, not on any network-supplied data, so there is no path for a remote unauthenticated attacker to reliably trigger it. Affected on kernels from 5.10; fixed in 6.12.111, 6.18.53, 7.2.7, and 7.3-rc3.

This is a classic case of an overstated NVD score for a Linux kernel driver bug. The NVD CVSS of 8.1 (AV:N/AC:H/PR:N/UI:N/C:H/I:H/A:H) implies a network-triggerable, unauthenticated, full-confidentiality/integrity/availability compromise - but the description does not support this. The root cause is that bnxt_rx_ring_reset() in the Broadcom bnxt_en NIC driver ignores allocation failures: when bnxt_alloc_one_tpa_info_data() returns -ENOMEM, the rx_tpa[] array is left partially uninitialized, TPA is re-enabled anyway, and a hardware agg_id can map to a zeroed slot, handing a zero DMA address to the device. This is triggered by memory-pressure allocation failure during a ring reset, NOT by any attacker-supplied network input, so the AV:N and PR:N assignments are not justified; the realistic outcome is data corruption or a device/kernel fault (DoS), not information disclosure. No EPSS score, no CISA KEV listing, and no public exploit are present. SSVC data is absent. The AC:H reflects the genuinely narrow, non-deterministic trigger window (an allocation must fail at exactly the wrong moment). Overall this is a low real-world priority defensive/robustness fix, not an actively exploitable network vulnerability - treat the 8.1 as inflated and the C:H/I:H as unsupported.

There is no realistic remote attack path. Under sustained memory pressure, a receive-ring reset (e.g., following an RX error or reconfiguration) triggers an allocation failure that leaves TPA (transparent packet aggregation) slots uninitialized; the device is then handed a zero DMA address, causing memory corruption or a kernel/device fault. No public exploit exists, and the condition depends on kernel memory exhaustion rather than any attacker-controlled input.