{"cve":"CVE-2026-97572","nvd":{"published":"2026-09-25T11:17:07.910","modified":"2026-10-19T10:17:26.347","status":"Received","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nbnxt_en: Propagate RX ring init failures in bnxt_init_nic()\n\nbnxt_init_rx_rings() returns an error when bnxt_alloc_one_rx_ring()\nfails, but bnxt_init_nic() discards that return value and calls\nbnxt_init_chip(), which enables TPA.\n\nIf an allocation fails, this could leave rxr->rx_tpa[] partially zeroed\nand TPA would be enabled over an array with zeroed entries. This would\nlead to a zeroed DMA address being handed out if the agg_idx is\ntranslated to a SW index at a zeroed entry.\n\nFix this by propagating the error out of bnxt_init_nic(). Both callers\nalready check its return value and unwind with bnxt_free_skbs() and\nbnxt_free_mem(), which tolerate a partially initialized RX ring.","cvss_v4":null,"cvss_v3":null,"cwes":[],"references":["https://git.kernel.org/stable/c/1f2d333ae2e1a73b7cc1c2a627587024cd147c01","https://git.kernel.org/stable/c/6b24eca42619b93f69aebc2aa0a9fd28ac9a5085","https://git.kernel.org/stable/c/8e6a850c0746bb4be167aedf1ee57469fcda09a9","https://git.kernel.org/stable/c/b4c40f2c80d7bf50648878bc206a39adfbfaec6c","https://git.kernel.org/stable/c/c3eb07e78e628243cbb9bbb0115db802fb7a303f"],"products":[],"source":"nvd","synced_at":"2026-10-19T22:56:02.509636177+00:00"},"epss":{"cve":"CVE-2026-97572","score":0.00211,"percentile":0.11185,"date":"2026-10-25"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}