VulnerabilityPublished 1 May 2026Updated 21 Oct 2026

CVE-2026-43034: Linux kernel · bnxt_en: set backing store type from query type

Affects Linux kernelSource CVE Database V5

Not known to be exploited · fixed in c66a27ca534580de1d28cf568f59fe5f50d43e15 : update Linux kernel when convenient.

Data as of 26 Oct 2026, 13:07 UTC

Severity

Unrated

Rated by Threat Radar · No CVSS score from NVD or the CNA

EPSS: 0.1% chance of exploitation in 30 days – higher than 4% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
Patch: Available – fixed in c66a27ca534580de1d28cf568f59fe5f50d43e15, c8d53b70166d1dc463ef42adb7293e1a770822c7, 29732b68a6816a815d58e9ab229844c23617e1e0 +1

Exploitation evidence

Disclosed: evidence found.
CVE published 1 May 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponised: Public exploit code exists in Metasploit or Exploit-DB, or CISA SSVC or the CVSS exploit maturity reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

What to do

Upgrade Linux kernel to c66a27ca534580de1d28cf568f59fe5f50d43e15, c8d53b70166d1dc463ef42adb7293e1a770822c7, 29732b68a6816a815d58e9ab229844c23617e1e0 or 4ee937107d52f9e5c350e4b5e629760e328b3d9f.

Affected software

Product	Affected	Fixed in
LinuxLinux	Affected ≥ 6a4d0774f02d61f8c75ffe2e38a8553410fe52e9, < c66a27ca534580de1d28cf568f59fe5f50d43e15	Fixed in c66a27ca534580de1d28cf568f59fe5f50d43e15
LinuxLinux	Affected ≥ 6a4d0774f02d61f8c75ffe2e38a8553410fe52e9, < c8d53b70166d1dc463ef42adb7293e1a770822c7	Fixed in c8d53b70166d1dc463ef42adb7293e1a770822c7
LinuxLinux	Affected ≥ 6a4d0774f02d61f8c75ffe2e38a8553410fe52e9, < 29732b68a6816a815d58e9ab229844c23617e1e0	Fixed in 29732b68a6816a815d58e9ab229844c23617e1e0
LinuxLinux	Affected ≥ 6a4d0774f02d61f8c75ffe2e38a8553410fe52e9, < 4ee937107d52f9e5c350e4b5e629760e328b3d9f	Fixed in 4ee937107d52f9e5c350e4b5e629760e328b3d9f
LinuxLinux	Affected =6.8	Fixed in–

Description

In the Linux kernel, the following vulnerability has been resolved: bnxt_en: set backing store type from query type bnxt_hwrm_func_backing_store_qcaps_v2() stores resp->type from the firmware response in ctxm->type and later uses that value to index fixed backing-store metadata arrays such as ctx_arr[] and bnxt_bstore_to_trace[]. ctxm->type is fixed by the current backing-store query type and matches the array index of ctx->ctx_arr. Set ctxm->type from the current loop variable instead of depending on resp->type. Also update the loop to advance type from next_valid_type in the for statement, which keeps the control flow simpler for non-valid and unchanged entries.

References

Community reviews

Loading reviews…