CVE-2026-53177

bnxt_en: Fix NULL pointer dereference

MEDIUM
5.5
CVSS Score
Published: June 25, 2026 at 08:38 AM UTC
Updated: October 15, 2026 at 02:20 AM UTC
1 product affected across 1 vendorLinux Kernel

Using Linux by Linux?

Get instant alerts when new vulnerabilities affect Linux - before attackers find them.

Real-time alertsTrack your software stackFree plan available
Severity
MEDIUM5.5
Exploit prediction
EPSS 0.1%

Description

In the Linux kernel, the following vulnerability has been resolved: bnxt_en: Fix NULL pointer dereference PCIe errors detected by a Root Port or Downstream Port cause error recovery services to run on all subordinate devices regardless of administrative state. The .error_detected() callback, bnxt_io_error_detected(), disables and synchronizes IRQs via bnxt_disable_int_sync(), which calls bnxt_cp_num_to_irq_num() to map completion rings to IRQs using bp->bnapi. Since bp->bnapi is allocated on NIC open and freed on NIC close, PCIe error recovery on a closed NIC can dereference a NULL pointer. Check if bp->bnapi is NULL before disabling and synchronizing IRQs.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

4.17 ≤ v < 5.15.2105.16 ≤ v < 6.1.1766.13 ≤ v < 6.18.366.19 ≤ v < 7.0.136.2 ≤ v < 6.6.1436.7 ≤ v < 6.12.947.17.1 rc17.1 rc27.1 rc37.1 rc47.1 rc57.1 rc67.1 rc7e5811b8c09df9bc80eabc95339fceded23f16289
Vendor states this is fixed in 08e57d014ea19f303d5d57a849beb846f37788b7 (fixed)
Vendor states this is fixed in 1449177b87f768353909e930a99b902675119b2b (fixed)
Vendor states this is fixed in 1a418ad0e5e525d1d117dd1601681f75455af320 (fixed)
Vendor states this is fixed in 3884976f87448e269908ae61bd5d62d54ce9c0c7 (fixed)
Vendor states this is fixed in 580844a9683afe7974856dd5b7886447435b3474 (fixed)
Vendor states this is fixed in 59c5a3e69c7630a811565937e64be70b08436761 (fixed)
Vendor states this is fixed in 964b1c3eb71afe58bb61c8b984164447e000ae8a (fixed)
Vendor states this is fixed in d930276f2cddd0b7294cac7a8fe7b877f6d9e08d (fixed)
Vendor states this is fixed in 4.17 (unaffected)
Vendor states this is fixed in 5.10.260 (unaffected)
Vendor states this is fixed in 5.15.210 (unaffected)
Vendor states this is fixed in 6.1.176 (unaffected)
Vendor states this is fixed in 6.12.94 (unaffected)
Vendor states this is fixed in 6.18.36 (unaffected)
Vendor states this is fixed in 6.6.143 (unaffected)
Vendor states this is fixed in 7.0.13 (unaffected)
Vendor states this is fixed in 7.1 (unaffected)

CVSS

Attack Vector
LOCAL
Complexity
LOW
Privileges
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
NONE
Integrity
NONE
Availability
HIGH
Vector?

Quick Info

StatusMODIFIED
CWE
CWE-476

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Free plan, no card