VulnerabilityPublished 25 Sep 2026Updated 19 Oct 2026

CVE-2026-97574: Linux kernel · bnxt_en: Don't free the live ring's TPA state on queue restart failure

Affects Linux kernelSource CVE Database V5

Not known to be exploited · fixed in e42287b4d38d653f7d4a47f6c29b0c01288bb050 : update Linux kernel when convenient.

Data as of 26 Oct 2026, 17:16 UTC

Severity

Medium

Rated Medium by Threat Radar's AI analysis · CVSS not yet scored by NVD

EPSS: 0.2% chance of exploitation in 30 days – higher than 10% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
Patch: Available – fixed in e42287b4d38d653f7d4a47f6c29b0c01288bb050, 0596a7caa6fc283e142716739099c038d8714082, 8ade95619cbfd1fc57f0f1a9a5ebdca2345a8d27 +2

Exploitation evidence

Disclosed: evidence found.
CVE published 25 Sep 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponised: Public exploit code exists in Metasploit or Exploit-DB, or CISA SSVC or the CVSS exploit maturity reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

What to do

Upgrade to a fixed release listed under Affected software.

Affected software

Product	Affected	Fixed in
LinuxLinux	Affected >=6.12.20 <6.12.112	Fixed in e42287b4d38d653f7d4a47f6c29b0c01288bb050 0596a7caa6fc283e142716739099c038d8714082 8ade95619cbfd1fc57f0f1a9a5ebdca2345a8d27 6.12.112 5ce7f36c334d723954855ac769ede2fe0e8f89c8
LinuxLinux	Affected =6.13	Fixed in–

AI-suggested

A fix is available in Linux kernel versions 6.12.112 and later, as well as in specific commits identified by their hashes. Users and administrators should upgrade to these fixed versions to mitigate the vulnerability. No additional mitigation steps are indicated.

Description

A vulnerability in the Linux kernel's bnxt_en driver involves improper handling of the live ring's TPA state during queue restart failure. Specifically, pointers to the live ring's memory are not properly cleared in a cloned structure, leading to potential freeing of memory still in use. This issue has been fixed by initializing the clone's pointers to NULL to prevent inadvertent freeing of live ring state.

Impact

This vulnerability can lead to a use-after-free condition in the Linux kernel's network driver, potentially causing system instability or crashes. There is no indication of known exploitation in the wild or direct remote exploitation. The impact is limited to affected kernel versions and requires triggering a queue restart failure with allocation failure.

Summary

The Linux kernel bnxt_en driver shallow copies the live RX ring into a clone using memcpy. While some pointers owned by the clone are cleared, the rx_tpa and rx_tpa_idx_map pointers remain pointing to the live ring's memory. If an allocation failure occurs and the error handling path frees the TPA info, the live ring's memory can be freed while still in use, causing a use-after-free condition. The fix involves initializing the clone's pointers to NULL to avoid freeing live ring memory inadvertently.

References

Community reviews

Loading reviews…

Exploitation evidence

What to do

Affected software

Description

AI analysisMachine-generated, updated 26 Oct 2026, 13:41 UTC

Technical details

References

Community reviews

Related threats