EUVD-2026-66575
GHSA-4frh-9v5h-wqj6
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Local kernel race requiring Broadcom bnxt NIC, TPH-capable PCIe, and privileged IRQ affinity manipulation; pure availability impact with no confidentiality or integrity consequence.
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Lifecycle Timeline
5DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
eth: bnxt: avoid deadlock when canceling IRQ affinity notifier
Unregistering IRQ affinity notifiers waits for the callback synchronously. bnxt takes the netdev instance lock in the notifier (to restart the queue) and cancels the work under the same lock. This may obviously deadlock.
Move the restart to the async service task. The queue restart isn't super time sensitive. Store the new TPH tag, schedule the task. Safely canceling the service task is already ironed out.
In bnxt_request_irq() the order of registering notifier, affinity and initial TPH programming has to be inverted. I think it was racy previously since user may trigger an update as soon as notifier is installed.
There's a small known gap - if pcie_tph_get_cpu_st() fails at init and the target tag is 0 we may miss programming the entry. This does not seem worth fixing, the code has skip-on-failure all over the place, anyway.
AnalysisAI
Deadlock vulnerability in the Linux kernel's bnxt (Broadcom NetXtreme) ethernet driver causes kernel hangs or crashes on systems with Broadcom bnxt NICs when an IRQ affinity notifier callback and the bnxt work-cancellation path simultaneously contend for the netdev instance lock. The affinity notifier callback acquires the lock to restart the queue while cancellation synchronously waits for that callback to finish - both paths block indefinitely, resulting in full availability loss for the affected network interface and potentially the host. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Three simultaneous conditions are required: (1) a Broadcom NetXtreme adapter must be physically present with the bnxt_en kernel module loaded; (2) the PCIe root complex and endpoint must both support TLP Processing Hints (TPH), enabling the affinity notifier registration path - this is hardware-dependent and not universally present; (3) an IRQ affinity change event (via irqbalance, CPU hotplug, or manual /proc/irq/N/smp_affinity writes) must race with a bnxt work cancellation path such as interface reconfiguration or driver shutdown. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The assigned CVSS 7.5 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) is almost certainly an erroneous assignment. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An automated irqbalance daemon or a CPU hotplug event triggers a CPU affinity change on an IRQ assigned to a Broadcom bnxt NIC at the same moment the kernel's bnxt teardown or reconfiguration path initiates work cancellation while holding the netdev instance lock. The affinity notifier callback fires and attempts to acquire that lock to restart the queue; simultaneously, the cancellation path calls the synchronous irq_set_affinity_notifier() waiting for the callback to complete. … |
| Remediation | Apply the upstream kernel patches available at https://git.kernel.org/stable/c/8b1118fc5a5d2cdc21cc07b5106921ad4f77c544 and https://git.kernel.org/stable/c/51e96fa31f7e7eac2cba8f854e24d36600cc040b, which move the queue restart into the asynchronous bnxt service task and correct the notifier registration ordering in bnxt_request_irq(). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, audit your Linux infrastructure to identify systems using Broadcom bnxt NICs and document their current kernel versions. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today