CVE-2026-23041

Root

Cause

In the Linux kernel's bnxt_en driver, the error path of bnxt_init_one() fails (e.g., bnxt_init_int_mode returns -ENODEV), the cleanup path calls bnxt_free_hwrm_resources() first, which destroys the DMA pool and sets bp->hwrm_dma_pool to NULL [1]. Then bnxt_ptp_clear() is invoked, which calls ptp_clock_unregister(). Since commit a60fc3294a37, ptp_clock_unregister() triggers ptp_disable_all_events(), which invokes the driver's .enable() callback (bnxt_ptp_enable()`) to disable PTP events before completing unregistration.

Exploitation

Mechanism

The bnxt_ptp_enable() callback attempts to send HWRM commands via bnxt_ptp_cfg_pin() and bnxt_ptp_cfg_event(), both of which call hwrm_req_init(). This function tries to allocate from bp->hwrm_dma_pool, which is already NULL due to the prior cleanup. This results in a NULL pointer dereference, as shown in the KASAN trace: the crash occurs at __hwrm_req_init (line 72 of bnxt_hwrm.c) [1]. The attack surface requires no special privileges — the vulnerability is triggered during normal driver initialization failure, so any user or process that triggers driver loading on a system with a bnxt NIC could potentially encounter the crash, leading to denial of service.

Impact

An attacker with local access or ability to influence driver initialization (e.g., through device hotplug) could cause a kernel NULL pointer dereference, resulting in a system crash or denial of service. The pointer dereference occurs before any network operations start, but after DMA pool destruction, making it a clean null-ptr-deref that panics the kernel.

Mitigation

The fix is to reorder the cleanup: call bnxt_ptp_clear() (which unregisters the PTP clock) before freeing HWRM resources. This ensures that the PTP callback chain is dismantled while the DMA pool is still valid [1]. The patch has been applied to the stable kernel tree as of commit 0174d5466cae. Systems running kernels prior to this fix, especially those with Broadcom bnxt_en NICs, should apply the update to avoid potential crashes on driver initialization failures.