In the Linux kernel, the following vulnerability has been resolved: bnxt_en: fix DMA mapping length for padded small packets Stefan Fleischmann… (CVE-2026-99081)

The Linux kernel bnxt_en driver had a vulnerability where small packets (less than 52 bytes) were padded to meet minimum size requirements, but the DMA mapping length used for the NIC's DMA engine was not updated to reflect this padding. Specifically, the length variable used in dma_map_single() remained at the original packet size, causing the hardware to read beyond the mapped memory region when the packet data was near a 4KB page boundary. This resulted in Intel IOMMU DMA read faults due to DMA overruns into unmapped adjacent pages. The issue was introduced after a commit that increased VLAN headroom, shifting skb->data offsets. The fix involved using skb_put_padto() to pad the skb before DMA mapping, ensuring the DMA length matches the padded packet size and preventing overruns.

The vulnerability causes the NIC's DMA engine to perform out-of-bounds reads beyond the mapped buffer, triggering Intel IOMMU DMA read faults. This can lead to transmit queue timeouts and network interface instability. There is no indication of remote code execution or data corruption, but the faulting behavior can disrupt network transmission on affected hardware.

A fix is available in the Linux kernel that changes the padding approach in the bnxt_en driver to ensure the DMA mapping length matches the padded packet size. Users should update to a kernel version that includes this fix. No additional mitigation steps are indicated or required beyond applying the official patch.