CVE-2026-43034

Vulnerability

Analysis

In the Linux kernel's bnxt_en driver, the function bnxt_hwrm_func_backing_store_qcaps_v2() stores resp->type from the firmware response into ctxm->type. This value is later used to index fixed backing-store metadata arrays such as ctx_arr[] and bnxt_bstore_to_trace[]. However, the correct index should be derived from the current loop variable, not from the potentially untrusted firmware response. This misassignment could lead to out-of-bounds array access if the firmware returns an unexpected type value.

Exploitation

Prerequisites

The bug is triggered during normal driver operation when the driver queries firmware capabilities via the HWRM interface. An attacker would need to be able to influence the firmware response, such as through a malicious PCIe device or compromised firmware. No special privileges are required beyond the ability to cause the driver to perform a backing store query, which occurs during device initialization.

Impact

If successfully exploited, the out-of-bounds access could corrupt kernel memory, leading to a system crash (denial of service) or potentially privilege escalation. The vulnerability is rated with a CVSS v3 score of 5.5 (Medium), indicating a moderate severity.

Mitigation

Patches have been applied to the Linux kernel stable branches to fix the issue by setting ctxm->type from the loop variable and updating the loop to advance the type from next_valid_type. Users should update their kernels to the latest stable release to mitigate this vulnerability.