Skip to main content

Linux Kernel EUVDEUVD-2026-27820

| CVE-2026-43260 HIGH
Double Free (CWE-415)
2026-05-06 Linux GHSA-w6jm-j85g-vpgj
Information Disclosure Linux
7.8
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
7.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
4.7 MEDIUM

Managing RSS contexts and cycling the link needs CAP_NET_ADMIN (PR:H) and a specific down/up race (AC:H); impact is mainly resource loss/instability (A:H, I:L), no confidentiality proven (C:N).

3.1 AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:H
4.0 AV:L/AC:H/AT:P/PR:H/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N
SUSE
HIGH
qualitative
Red Hat
5.5 MEDIUM
qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

4
Analysis Generated
Jul 24, 2026 - 00:53 vuln.today
CVSS changed
May 08, 2026 - 20:37 NVD
7.8 (HIGH)
Patch available
May 06, 2026 - 13:32 EUVD
CVE Published
May 06, 2026 - 11:28 nvd
HIGH 7.8

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

bnxt_en: Fix RSS context delete logic

We need to free the corresponding RSS context VNIC in FW everytime an RSS context is deleted in driver. Commit 667ac333dbb7 added a check to delete the VNIC in FW only when netif_running() is true to help delete RSS contexts with interface down.

Having that condition will make the driver leak VNICs in FW whenever close() happens with active RSS contexts. On the subsequent open(), as part of RSS context restoration, we will end up trying to create extra VNICs for which we did not make any reservation. FW can fail this request, thereby making us lose active RSS contexts.

Suppose an RSS context is deleted already and we try to process a delete request again, then the HWRM functions will check for validity of the request and they simply return if the resource is already freed. So, even for delete-when-down cases, netif_running() check is not necessary.

Remove the netif_running() condition check when deleting an RSS context.

AnalysisAI

Local privilege escalation / memory corruption in the Linux kernel's bnxt_en driver (Broadcom NetXtreme-C/E Ethernet) arises from flawed RSS context deletion logic that mishandles firmware VNIC resources when an interface is brought down and back up with active RSS contexts. The bug, classified as a double free (CWE-415), can cause VNIC resource leaks and failed context restoration, with potential for kernel memory corruption. There is no public exploit identified at time of analysis, and the EPSS probability is negligible (0.02%).

Technical ContextAI

The affected component is bnxt_en, the in-tree Linux driver for Broadcom NetXtreme-C/E series network adapters, specifically its Receive Side Scaling (RSS) context management. RSS contexts are backed by firmware (FW) VNIC resources negotiated via HWRM (Hardware Resource Manager) calls. Commit 667ac333dbb7 introduced a netif_running() guard so the FW VNIC was only deleted when the interface was up; this left VNICs leaked in FW on close() while contexts were still active. On the next open(), RSS context restoration attempts to create VNICs beyond the driver's reservation, which FW may reject. The CWE-415 (Double Free) classification indicates the mismatched allocation/free bookkeeping of these VNIC resources, where a resource can be freed or re-processed inconsistently across the down/up cycle.

RemediationAI

Apply the vendor kernel update: upgrade to a fixed release - Linux 6.12.75, 6.18.16, 6.19.6, or 7.0 (or your distribution's backported equivalent from Red Hat or SUSE). The upstream fix simply removes the netif_running() condition when deleting an RSS context, so it is a contained, low-risk patch to backport. The stable-tree commits are available at https://git.kernel.org/stable/c/348a5f8d06c7bdf954e13c17ad5f80b59a075604 and the parallel commits listed in the references, and the coordinating advisory is at https://nvd.nist.gov/vuln/detail/CVE-2026-43260. If immediate patching is not possible, restrict CAP_NET_ADMIN so untrusted users cannot create/delete RSS contexts or cycle the interface, and avoid configuring multiple RSS contexts on bnxt_en interfaces that are frequently brought down and up (trade-off: reduced RSS flexibility and multi-queue steering flexibility on affected NICs). These are compensating controls only; the driver update is the definitive fix.

Same weakness CWE-415 – Double Free

View all
CVE-2014-0502 HIGH POC
8.8
CVE-2018-0101 CRITICAL POC
10.0
CVE-2023-25136 MEDIUM POC
6.5
CVE-2026-33824 CRITICAL POC
9.8
CVE-2014-1767 HIGH POC
7.2
CVE-2016-5768 CRITICAL POC
9.8
CVE-2016-5772 CRITICAL POC
9.8
CVE-2016-3132 CRITICAL POC
9.8

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: High
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed

Share

EUVD-2026-27820 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy