bnxt_en driver CVE-2026-99081

Requires a host running the Linux kernel bnxt_en driver with a Broadcom NetXtreme-E NIC (e.g. BCM57412), Intel IOMMU/VT-d enabled so DMA is translated, and traffic on a VLAN or macvlan interface. The driver must transmit packets smaller than BNXT_MIN_PKT_SIZE (52 bytes) that are padded (e.g. 42-byte untagged ARP frames), AND skb->data must land within the pad bytes of a 4KB page boundary so the oversized DMA read crosses into an unmapped page. This boundary alignment is a memory-layout condition, not a reliably attacker-controlled input. The issue was exposed by commit 447cbe95ebb9, which rounded LL_RESERVED_SPACE from 48 up to 64 bytes and shifted skb->data offsets. Limiting factors: specific Broadcom hardware, IOMMU translation enabled, VLAN/macvlan configuration, small-frame traffic, and probabilistic page-boundary alignment all must coincide; outside these conditions the bug does not manifest.

This is a high-CVSS (7.5, A:H) but low-real-world-urgency issue. The CVSS vector (AV:N/AC:L/PR:N/UI:N) describes an availability-only impact, and all corroborating signals point to limited practical risk: EPSS is 0.21% (10th percentile), there is no CISA KEV listing, and no public exploit is identified. The vuln.today decision label is 'this_week' (not act_now/emergency), consistent with a patch-available denial-of-service fix rather than an actively exploited threat. The signals are coherent rather than conflicting, but note a metric tension: the input CVSS marks AC:L, whereas the described trigger requires skb->data to land within a few bytes of a 4KB page boundary - a memory-layout condition that is not reliably attacker-controlled, which argues for higher attack complexity than AC:L implies. Also note a tag conflict: the input Tags include 'Information Disclosure', but the CVSS confidentiality impact is C:N and the documented effect is an IOMMU DMA-read fault that hangs the TX queue (a DoS), so the severity should be read as availability, not disclosure. Overall this is a real but narrowly-scoped reliability/DoS bug affecting specific Broadcom NIC hardware under Intel IOMMU, best handled as routine patching.

On a host using the Broadcom bnxt_en driver with a BCM57412 NetXtreme-E NIC and Intel IOMMU (VT-d) enabled, traffic on a VLAN or macvlan interface generates small sub-52-byte frames (such as 42-byte ARP) that the driver pads. Because the DMA mapping length is left at the original unpadded length while the hardware descriptor is programmed with the padded length, the NIC reads past the mapped region; if skb->data sits near a 4KB page boundary the read overruns into an unmapped page, triggering an IOMMU fault that aborts the message and hangs the transmit queue (NETDEV WATCHDOG timeout). No public exploit is identified; triggering is largely incidental to normal small-frame traffic rather than a reliably controllable attack.