Linux hwe edge: In the Linux kernel, the following vulnerability has been resolved: eth: bnxt: avoid deadlock when canceling IRQ affinity notifier Unregistering IRQ… (CVE-2026-74745)

CVE-2026-74745 addresses a deadlock condition in the Linux kernel's bnxt Ethernet driver. The deadlock arises because unregistering IRQ affinity notifiers waits synchronously for callbacks while the notifier takes the netdev instance lock to restart the queue and cancels work under the same lock. This lock ordering can cause a deadlock. The fix involves moving the queue restart to an asynchronous service task, which is less time-sensitive, and adjusting the order of registering notifier, affinity, and initial TPH programming to avoid race conditions. A minor known gap remains if pcie_tph_get_cpu_st() fails at initialization, but it is considered acceptable.

The vulnerability can cause a deadlock in the network driver, leading to denial of service (availability impact). There is no impact on confidentiality or integrity. The CVSS v3.1 score is 7.5 (High) primarily due to the availability impact and the network attack vector with no privileges required or user interaction.

A fix has been implemented in the Linux kernel to address this deadlock issue by moving queue restart operations to an asynchronous task and adjusting initialization order. Users should apply the official kernel updates that include this fix. Since this is a kernel-level fix, updating to the patched kernel version is the recommended mitigation. Patch status is not explicitly stated here; check the vendor or distribution advisories for the exact fixed kernel versions and apply updates accordingly.