Linux Kernel EUVD-2026-26633

Exploitation requires: (1) local system access as an authenticated user (not root), (2) a Broadcom NetXtreme Ethernet adapter using the bnxt_en driver loaded in the kernel, and (3) the ability to trigger backing store capability query operations, typically through ioctl or netlink commands available to unprivileged users. The vulnerability cannot be exploited remotely over the network. Systems without Broadcom NetXtreme Ethernet adapters or with the bnxt_en driver disabled are not affected. Default kernel configurations with the driver loaded are vulnerable.

This is a local denial of service vulnerability with moderate real-world risk. CVSS 5.5 (AV:L/AC:L/PR:L) correctly reflects the local access requirement and authenticated privilege level, resulting in denial of service impact. EPSS is extremely low at 0.02% (4th percentile), indicating minimal probability of broad exploitation despite the moderate CVSS score. The attack vector is local (AV:L) and requires low privilege (PR:L), limiting exploitability to users already authenticated on the target system. The impact is confined to availability (denial of service) with no confidentiality or integrity impact. The vulnerability is less critical than higher-CVSS network vulnerabilities because it requires local system access and authenticated user context. However, on multi-user or container systems where unprivileged users have shell access, this could be a denial of service vector. The combination of low EPSS and no KEV listing suggests this is primarily a reliability issue rather than an active security threat.

An authenticated local user with standard user privileges executes code that triggers a backing store capability query operation on a system with a Broadcom NetXtreme Ethernet adapter. The vulnerability in the bnxt_en driver causes an out-of-bounds array access when the firmware response type value is used to index fixed metadata arrays, leading to kernel memory corruption and system crash (denial of service). No publicly available exploit code has been identified.