SB2026050784 - Missing Release of Resource after Effective Lifetime in Linux kernel broadcom bnxt driver

Description

This security bulletin contains information about 1 vulnerability.

1) Missing Release of Resource after Effective Lifetime (CVE-ID: CVE-2026-43260)

CWE-ID: CWE-772 - Missing Release of Resource after Effective Lifetime

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource management in the bnxt_en RSS context delete logic when deleting RSS contexts during interface close and subsequent restoration. A local user can trigger repeated RSS context deletion and restoration cycles to cause a denial of service.

The issue can cause firmware VNIC resources to be leaked, and subsequent open operations may fail to restore active RSS contexts.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/079986d6db1f8e3d50c55f400cf998ac9690d2c8
• https://git.kernel.org/stable/c/348a5f8d06c7bdf954e13c17ad5f80b59a075604
• https://git.kernel.org/stable/c/9a9b89eea4a9cc7726702946ff688d716962fabd
• https://git.kernel.org/stable/c/e123d9302d223767bd910bfbcfe607bae909f8ac