Linux Kernel EUVD-2026-64384

Exploitation requires all of the following conditions simultaneously: (1) A Broadcom NetXtreme-E network adapter managed by the bnxt_en Linux kernel driver - specifically P5-generation or older silicon such as the Broadcom 57508 is reported in field incidents, though the fix applies to all generations; (2) TCP Packet Aggregation (TPA/LRO) must be enabled on the interface - this is often enabled by default on server-class Broadcom adapters but varies by distribution and configuration; (3) PCIe Relaxed Ordering (RO) must be enabled - active on some ARM-based platforms by default, particularly reported on ARM servers; (4) The affected kernel version (prior to the per-branch fixes noted above) must be running. Exploitation is limited to: non-ARM platforms where RO is typically disabled by default or newer chips that auto-disable RO when EOP is active, environments with TPA disabled, and kernel versions containing the fix. The vulnerability does not require any network authentication from the attacker's perspective, but the triggering of corruption is hardware-configuration-dependent, not reliably achievable against arbitrary targets.

The NVD-assigned CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L, score 8.2) reflects the worst-case scenario where network-delivered traffic triggers silent data corruption with no attacker authentication required. However, this vector is misleading on complexity: AC:L overstates exploitability because the corruption only manifests when both TPA and Relaxed Ordering are simultaneously enabled on a Broadcom NetXtreme-E adapter - a configuration not present in most deployments. The EPSS score of 0.21% at the 12th percentile aligns with the low real-world exploitation likelihood. This CVE is absent from CISA KEV, and no public proof-of-concept or exploit code has been identified. The practical risk profile is best described as high-impact but highly conditional: systems meeting all prerequisites (Broadcom bnxt_en NIC, TPA enabled, RO enabled, particularly on ARM) face genuine data integrity risk, but the configuration combination is niche relative to the Linux kernel install base. The 'Information Disclosure' tag in source data appears to be a mislabel - the actual impact is data integrity corruption, not disclosure.

An attacker on a network segment shared with a vulnerable host sends a high volume of crafted TCP traffic designed to saturate the AGG ring on a Broadcom NetXtreme-E adapter where TPA and Relaxed Ordering are both active. The NIC's DMA engine, subject to Relaxed Ordering, delivers EOP zero-padding bytes that overwrite the beginning of the next segment's payload in host memory. The result is silent corruption of application-layer data received from the network - potentially corrupting database writes, file transfers, or in-memory state - without any crash or visible error indicator. No public proof-of-concept exists at time of analysis.