Linux Kernel EUVD-2026-86878

Requires a host running the Broadcom bnxt_en driver on affected NICs (notably BCM57608) whose firmware advertises fewer concurrent TPAs than the FW TPA ID range - the documented case is firmware version 233 advertising 32 TPAs while FW IDs span 0..1023. TPA (transparent/large-receive-offload aggregation) must be active on the RX path. Exploitation is not attacker-driven in a meaningful sense: the out-of-bounds index arises deterministically from the firmware-advertised max_tpa and manifests as a boot/RX-time crash. Limiting factors: the flaw is confined to specific Broadcom hardware+firmware combinations (not all bnxt_en devices), affects only kernels built from commit ec4d8e7cf024 onward, and produces a denial-of-service crash rather than a demonstrated code-execution or data-disclosure primitive.

The NVD CVSS of 8.1 (AV:N/AC:H/PR:N/UI:N/C:H/I:H/A:H) substantially overstates the real-world risk of this bnxt_en driver flaw. The description makes clear this is a deterministic, hardware/firmware-gated out-of-bounds write that manifests as a 'crash at boot' on affected Broadcom NICs (e.g. BCM57608 running firmware version 233 that advertises only 32 concurrent TPAs). The AV:N and C:H/I:H claims are not supported by the evidence: the software-ID-to-array-index miscalculation in bnxt_alloc_agg_idx is driven by firmware-advertised TPA capacity, not by attacker-crafted network input, and the observed effect is a general-protection fault / kernel panic (denial of service), not confirmed confidentiality or integrity compromise. The single 'silent' out-of-bounds write raises a theoretical memory-corruption angle, but no exploitation primitive is demonstrated. No EPSS score, KEV listing, POC, or SSVC data is provided; exploitation status is therefore 'no public exploit identified.' In practice this is a stability/DoS regression affecting a specific hardware+firmware combination - a genuine bug worth patching on affected fleets, but far below the priority its 8.1 score implies. The vendor's own 'Denial Of Service' tag is more accurate than the C:H/I:H CVSS impact metrics.

An operator boots a Linux host equipped with a Broadcom BCM57608 NIC whose firmware (v233) advertises only 32 concurrent TPAs; during normal RX processing the driver wraps a firmware TPA ID into a software ID above 31 and indexes past the 32-entry rx_tpa array, producing an out-of-bounds write and a subsequent dereference that panics the kernel in bnxt_rx_pkt. No attacker action is required - the fault reproduces from ordinary received traffic on the affected hardware, effectively a self-inflicted boot-time denial of service. No public exploit code exists for this issue.