The Linux kernel bnxt driver had a vulnerability (CVE-2026-74269) caused by an underflow in the calculation of skb head in bnxt_rx_multi_page_skb during XDP head-grow operations. Specifically, the subtraction of rx_offset from data_ptr could result in an address before the fragment start, corrupting the page pool fragment reference count. This corruption could cause pages to be prematurely recycled and handed out again, leading to a double free on driver teardown. The fix involved adding an offset field to struct bnxt_sw_rx_bd to correctly compute fragment start addresses and adjusting skb construction accordingly. This resolved crashes in the xdp.py test test_xdp_native_adjst_head_grow_data on bnxt machines.

The vulnerability can cause memory corruption due to incorrect reference counting of page fragments, leading to premature recycling of memory pages. This can result in a double free condition during driver teardown, which may cause system instability or crashes. No direct evidence of exploitation in the wild is reported.

A fix for this vulnerability has been implemented in the Linux kernel by adding an offset field and correcting skb head calculations in the bnxt driver. Users should apply the official kernel updates that include this patch once available. Patch status is not yet confirmed in this data — check the vendor advisory or Linux kernel mailing lists for the current remediation guidance.