EUVD-2026-64384
GHSA-fmvg-rgc2-qx29
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L
AV:N because network traffic triggers corruption; AC:H because TPA, Relaxed Ordering, and specific Broadcom hardware must all be present simultaneously.
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L
Lifecycle Timeline
5DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
bnxt_en: Disable EOP for TPA on all chips to prevent data corruption
EOP (End of frame padding) on the AGG ring may cause overlapping of zero padding at the end of one segment with the next segment's data. If Relaxed Ordering (RO) is enabled, the zero padding may overwrite valid data in the next segment and corrupt the data. Older chips (P5 and older) do not automatically disable RO when EOP is enabled. On some ARM systems, data corruption was reported on 57508 (P5) chips with RO enabled.
Always disable EOP on all chips on the AGG rings when TPA is enabled to fix the data corruption.
AnalysisAI
Data corruption in the Linux kernel bnxt_en driver (Broadcom NetXtreme-E) occurs when TCP Packet Aggregation (TPA) is active alongside PCIe Relaxed Ordering (RO) on AGG rings. When EOP (End-of-frame padding) is used, zero-padding bytes appended at the end of one aggregated segment can spill over and overwrite valid data at the start of the subsequent segment. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires all of the following conditions simultaneously: (1) A Broadcom NetXtreme-E network adapter managed by the bnxt_en Linux kernel driver - specifically P5-generation or older silicon such as the Broadcom 57508 is reported in field incidents, though the fix applies to all generations; (2) TCP Packet Aggregation (TPA/LRO) must be enabled on the interface - this is often enabled by default on server-class Broadcom adapters but varies by distribution and configuration; (3) PCIe Relaxed Ordering (RO) must be enabled - active on some ARM-based platforms by default, particularly reported on ARM servers; (4) The affected kernel version (prior to the per-branch fixes noted above) must be running. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The NVD-assigned CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L, score 8.2) reflects the worst-case scenario where network-delivered traffic triggers silent data corruption with no attacker authentication required. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker on a network segment shared with a vulnerable host sends a high volume of crafted TCP traffic designed to saturate the AGG ring on a Broadcom NetXtreme-E adapter where TPA and Relaxed Ordering are both active. The NIC's DMA engine, subject to Relaxed Ordering, delivers EOP zero-padding bytes that overwrite the beginning of the next segment's payload in host memory. … |
| Remediation | The primary remediation is upgrading to a fixed Linux kernel version for the applicable stable branch: 5.10.265, 5.15.216, 6.1.183, 6.6.152, 6.18.45, 7.1.9, or 7.2, as published to the stable kernel tree at https://git.kernel.org/stable/. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all Linux systems using Broadcom NetXtreme-E adapters (model 57508 or P5-generation), especially ARM deployments. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today