Skip to main content

Linux Kernel EUVDEUVD-2026-59416

| CVE-2026-74269 CRITICAL
2026-08-15 Linux GHSA-qr85-5764-cw3m
Denial Of Service Linux
9.8
CVSS 3.1 · Vendor: Linux
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Recon
    Gain CAP_NET_ADMIN on bnxt host
  2. Delivery
    Attach native XDP head-grow program
  3. Exploit
    Receive RX traffic on interface
  4. Install
    Trigger head-pointer underflow in skb build
  5. C2
    Corrupt page-pool refcount
  6. Execute
    Double free on recycle/teardown
  7. Impact
    Kernel crash / DoS

Vulnerability Assessment

Exploitation Conditions

Requires a Broadcom NetXtreme NIC using the bnxt_en driver in page (page-pool) RX mode, with a native XDP program attached that grows the packet head (the head-grow / xdp_adjust_head-with-negative-offset path, as exercised by test_xdp_native_adjst_head_grow_data). Attaching native XDP is a privileged operation (CAP_NET_ADMIN/CAP_BPF), so exploitation presupposes local privileged control over the interface configuration rather than remote unauthenticated access. Limiting factors: only bnxt hardware is affected (other rx_skb_func implementations are not), the head-grow XDP feature must be in use, and the corruption depends on fragment offset conditions (e.g. fragment starting at low offset); default configurations without XDP head-grow are not exposed.
Impact

The signals conflict sharply. The input CVSS of 9.8 (AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:H) is the boilerplate score frequently auto-assigned to Linux kernel CVEs and overstates real risk: exploitation is not remote-unauthenticated in practice. Triggering the bug requires a native XDP program that grows the packet head attached to a bnxt interface - attaching native XDP requires CAP_NET_ADMIN/CAP_BPF, i.e. local privileged configuration, so the effective attack vector is local and privileged, not network-facing. The supporting intelligence agrees with the lower-risk read: EPSS is 0.15% (5th percentile), the tag set is 'Denial Of Service, Linux', there is no KEV listing and no known POC, and the observable impact is refcount corruption leading to a crash. No SSVC decision was provided. Net assessment: this is a legitimate stability/security defect worth patching on bnxt-based hosts (especially those running XDP workloads), but it is NOT a drop-everything remote-RCE despite the 9.8 - the network vector in the input CVSS is not supported by the description, which implies local, privileged, configuration-dependent triggering. Verify the vector with the kernel security team before treating as network-exploitable.
Exploit ScenarioDerived

A local user or workload with CAP_NET_ADMIN/CAP_BPF on a host with a Broadcom bnxt NIC attaches a native XDP program that adjusts the packet head to grow by up to 256 bytes; incoming traffic then triggers the head-pointer underflow, corrupting page-pool refcounts and causing a premature page recycle and eventual double free that crashes the kernel. No public exploit is identified, but the crash is reliably reproducible via the kernel's own selftest (xdp.py test_xdp_native_adjst_head_grow_data), so a working trigger effectively exists in the upstream test suite.
Act Now Prioritize within 24-48h. Why: CRITICAL severity.
Patch available 0.2% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Aug 17, 2026

Memory corruption in the Linux kernel's bnxt (Broadcom NetXtreme) Ethernet driver arises when an XDP program grows the packet head, causing a head-pointer underflow in bnxt_rx_multi_page_skb that drops a page-pool fragment reference on the wrong page or fragment. This corrupts page-pool refcounts, allowing a page to be recycled while still in use and producing a double free on driver teardown, which realistically manifests as a kernel crash or memory corruption on hosts using Broadcom bnxt NICs with native XDP. No public exploit identified at time of analysis, and it is not listed in CISA KEV; EPSS is low at 0.15% (5th percentile).

RemediationAI

Patch available per vendor advisory: apply the upstream stable fix, available as kernel.org commits bb72b1c6755631c74b7e0878ee55bb81c06776c0 and e26657fe3b85c068b01f42bb0c602f242d643ba9, by updating to the stable kernel release for your series that includes them (consult your distribution's advisory for the exact packaged version, as the EUVD version data here is inconsistent and no single clean fixed release number is independently confirmed). If you cannot patch immediately, the most effective compensating control is to avoid attaching native XDP programs that grow the packet head on bnxt interfaces - detach or disable native/XDP offload on affected Broadcom NetXtreme NICs (trade-off: loss of XDP-based fast-path filtering/load-balancing), or restrict CAP_NET_ADMIN/CAP_BPF so untrusted local users cannot attach XDP programs (trade-off: may break legitimate network-management tooling and containers that manage interfaces). Advisory reference: https://nvd.nist.gov/vuln/detail/CVE-2026-74269.

Affected VersionsENISA

Linux patch: 0
Linux f6974b4c2d8e1062b5a52228ee47293c15b4ee1e <e26657fe3b85c068b01f42bb0c602f242d643ba9
Linux 6.4.10 <6.5
Linux 6.5
Linux e9f11bfc03fb0d3c86f91b8ae945bb10f7e19c16
Linux patch: 7.2-rc1
Linux f6974b4c2d8e1062b5a52228ee47293c15b4ee1e <bb72b1c6755631c74b7e0878ee55bb81c06776c0
Linux ae0e135dc900827687ecc684c2bbb57aae48d318
Linux patch: 7.1.5
Linux 6.1.45 <6.2

Affected Packages

euvd linux fix: 6.2, 6.5

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

The affected component is the bnxt_en driver for Broadcom NetXtreme-C/E network adapters, specifically its page-pool-based RX path and native XDP (eXpress Data Path) integration. In page mode, bp->rx_offset is NET_IP_ALIGN + XDP_PACKET_HEADROOM (258 bytes on x86_64). When XDP grows the head by up to 256 bytes, data_ptr is shifted near frag_start+2, and napi_build_skb(data_ptr - bp->rx_offset, ...) lands before the fragment's true start, so the freed page-pool reference no longer matches the fragment that was actually allocated. The root-cause class is a use-after-free/double-free stemming from an out-of-bounds pointer computation (CWE assignment is N/A in the input, but this is effectively CWE-416/CWE-415 driven by an integer/pointer underflow). A prior commit that added support for native page sizes >= 64K unintentionally broke the head-grow case; the fix adds an offset field to struct bnxt_sw_rx_bd, mirroring bnxt_sw_rx_agg_bd, so the skb is built at page_address(page) + offset with skb_reserve. The CPE data is generic (cpe:2.3:a:linux:linux:*), reflecting that NVD tracks this at the kernel level rather than pinpointing the driver.

Know when the next one hits your stack

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (Linux) PRIMARY 9.8 CRITICAL
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
vuln.today AI 4.7 MEDIUM

Attaching native XDP requires CAP_NET_ADMIN (PR:H) and local config, triggering is condition-dependent (AC:H/AV:L); impact is chiefly a crash (A:H) with limited integrity from corruption.

3.1 AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:H
4.0 AV:L/AC:H/AT:N/PR:H/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N
SUSE 6.1 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H
Red Hat 7.0 HIGH

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

4
CVSS changed
Aug 17, 2026 - 06:22 NVD
9.8 (CRITICAL)
Patch available
Aug 15, 2026 - 07:20 EUVD
CVE Published
Aug 15, 2026 - 05:57 cve.org
UNKNOWN (no severity yet)
CVE Published
Aug 15, 2026 - 05:57 cve.org
CRITICAL 9.8

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

bnxt: fix head underflow on XDP head-grow

The xdp.py test test_xdp_native_adjst_head_grow_data crashes when run on a bnxt machine (and also crashes in NIPA).

It seems that the bug is an underflow in bnxt_rx_multi_page_skb, which builds the skb head:

napi_build_skb(data_ptr - bp->rx_offset, rxr->rx_page_size);

The problem with this expression is that in page mode, rx_offset is:

bp->rx_offset = NET_IP_ALIGN + XDP_PACKET_HEADROOM;

Which evaluates (at least on x86_64) to 258.

The test test_xdp_native_adjst_head_grow_data tests a case where the head is adjusted by -256.

When this test runs, data_ptr is shifted to frag_start + 2 (where frag_start = page_address(page) + offset).

Then, bnxt_rx_multi_page_skb is invoked and the napi_build_skb expression subtracts 258, landing at an address before frag_start. This could be either the previous fragment or the previous physical page when the offset is < 256 (e.g. if the fragment started at offset 0).

When the skb is freed, the page pool fragment reference is dropped on either the wrong page or the wrong frag of the right page. In either case, the corrupted reference count can lead to the page being prematurely recycled while still in use. Once (incorrectly) recycled, it can be handed out again and on driver teardown this would result in a double free.

The commit under fixes updated this code to handle the case where the native page size is >= 64k, but it unintentionally broke the head grow case.

To fix this, add an offset field to struct bnxt_sw_rx_bd, mirroring the existing offset field in struct bnxt_sw_rx_agg_bd. Populate it on allocation and preserve it on reuse.

In bnxt_rx_multi_page_skb, use the newly added offset field to compute the fragment start and pass that to napi_build_skb. Adjust the layout with skb_reserve.

There are two cases, the non-adjustment case and the adjustment case.

In both cases, the skb is built at page_address(page) + offset to account for the case where the native page size >= 64K and skb_reserve is called with data_ptr - (page_address(page) + offset). That difference equals bp->rx_offset when data_ptr was not moved, or bp->rx_offset + xdp_adjust when XDP adjusted the head.

Re-running the failing test with this commit applied causes the test to run successfully to completion.

The other rx_skb_func implementations don't have this issue.

Executive ViewAI

Why It Matters

A critical memory corruption vulnerability in Linux kernel's Broadcom bnxt Ethernet driver can cause kernel crashes and system instability on hosts running XDP-enabled configurations, potentially disrupting service availability and causing data corruption. Organizations operating infrastructure with Broadcom NetXtreme NICs-particularly those actively using XDP packet processing-require immediate patching to restore system stability. A vendor patch is available and should be prioritized for deployment.

Business Impact: High
Compensating Controls

Apply vendor patch.

Threat Intelligence Overview

EPSS Score
0.2%
Top 95% exploitable
Prevalence
High
Broadcom NetXtreme bnxt NICs are widely deployed in enterprise and datacenter servers
Data Quality
6 sources
Confidence: High
EUVD NVD CVE.org EPSS MSRC Vendor VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity CRITICAL
CISA KEV No
Public POC No
EPSS 0.2%
Patch available Yes
Active threat No
Deciding rule
CRITICAL severity
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Scheduled
Exploitation· derived
None
System Exposure· derived
Open
Automatable· derived
Yes
Human Impact
High

Priority Score

49
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +49
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Denial of Service MEDIUM

Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: Important
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 16.0 Affected

References

Advisories & patches
ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-74269 ADVISORY https://ubuntu.com/security/notices/USN-8781-1 ADVISORY https://vuldb.com/vuln/390240 REF https://git.kernel.org/stable/c/3e8f3959a7fd28461b8cd9708c21286b4250b77a REF https://git.kernel.org/stable/c/4c03275bc4435cc8e25f7f3f08aff58c0e783d8d REF https://git.kernel.org/stable/c/59f6211c006cb5936b443fb396eb43864ca21ed5 REF https://git.kernel.org/stable/c/bb72b1c6755631c74b7e0878ee55bb81c06776c0 REF https://git.kernel.org/stable/c/e26657fe3b85c068b01f42bb0c602f242d643ba9 REF https://git.kernel.org/stable/c/ff34e5a26a26c92142afea11455e259c4c4c617b

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy