CVE-2026-74697
Full vulnerability record from the local CVENow database.
Description
In the Linux kernel, the following vulnerability has been resolved: bnxt_en: Disable EOP for TPA on all chips to prevent data corruption EOP (End of frame padding) on the AGG ring may cause overlapping of zero padding at the end of one segment with the next segment's data. If Relaxed Ordering (RO) is enabled, the zero padding may overwrite valid data in the next segment and corrupt the data. Older chips (P5 and older) do not automatically disable RO when EOP is enabled. On some ARM systems, data corruption was reported on 57508 (P5) chips with RO enabled. Always disable EOP on all chips on the AGG rings when TPA is enabled to fix the data corruption.
Severity
HIGH
CVSS score
8.2
(v3.1)
Vulnerability status
Received
Source identifier
416baaa9-dc9f-4396-8d5f-8c081fb06d67
Published
2026-08-22 16:16:44.280000
Last modified
2026-10-21 13:19:49.140000
View original CVE JSON
{
"id": "CVE-2026-74697",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"published": "2026-08-22T16:16:44.280",
"lastModified": "2026-10-21T13:19:49.140",
"vulnStatus": "Received",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbnxt_en: Disable EOP for TPA on all chips to prevent data corruption\n\nEOP (End of frame padding) on the AGG ring may cause overlapping of\nzero padding at the end of one segment with the next segment's data.\nIf Relaxed Ordering (RO) is enabled, the zero padding may overwrite\nvalid data in the next segment and corrupt the data. Older chips\n(P5 and older) do not automatically disable RO when EOP is enabled.\nOn some ARM systems, data corruption was reported on 57508 (P5)\nchips with RO enabled.\n\nAlways disable EOP on all chips on the AGG rings when TPA is enabled\nto fix the data corruption."
},
{
"lang": "es",
"value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nbnxt_en: Deshabilitar EOP para TPA en todos los chips para prevenir la corrupción de datos\n\nEOP (relleno de fin de trama) en el anillo AGG puede causar la superposición de relleno de ceros al final de un segmento con los datos del siguiente segmento. Si Relaxed Ordering (RO) está habilitado, el relleno de ceros puede sobrescribir datos válidos en el siguiente segmento y corromper los datos. Chips más antiguos (P5 y anteriores) no deshabilitan automáticamente RO cuando EOP está habilitado. En algunos sistemas ARM, se informó de corrupción de datos en chips 57508 (P5) con RO habilitado.\n\nDeshabilitar siempre EOP en todos los chips en los anillos AGG cuando TPA está habilitado para corregir la corrupción de datos."
}
],
"affected": [
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"affectedData": [
{
"vendor": "Linux",
"product": "Linux",
"defaultStatus": "unaffected",
"programFiles": [
"drivers/net/ethernet/broadcom/bnxt/bnxt.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"versions": [
{
"version": "bfcd8d791ec18496772d117774398e336917f56e",
"lessThan": "68c181af7cd1ca9cbf29acd95911073bfd3c6397",
"versionType": "git",
"status": "affected"
},
{
"version": "bfcd8d791ec18496772d117774398e336917f56e",
"lessThan": "7aee22a35978b44784612c156e358e375ddf5d16",
"versionType": "git",
"status": "affected"
},
{
"version": "bfcd8d791ec18496772d117774398e336917f56e",
"lessThan": "410da4428b1f47bf9a84bdc0bcaa089d73ba2048",
"versionType": "git",
"status": "affected"
},
{
"version": "bfcd8d791ec18496772d117774398e336917f56e",
"lessThan": "b61c4911204a0a2f900e538d64ceb608f6c9614d",
"versionType": "git",
"status": "affected"
},
{
"version": "bfcd8d791ec18496772d117774398e336917f56e",
"lessThan": "927e2617a36f49752cb5613900ca21f40593f07d",
"versionType": "git",
"status": "affected"
},
{
"version": "bfcd8d791ec18496772d117774398e336917f56e",
"lessThan": "aab3b5f4d8ec8598606ee011e219ef824ae25ca0",
"versionType": "git",
"status": "affected"
},
{
"version": "bfcd8d791ec18496772d117774398e336917f56e",
"lessThan": "c1962ab4645a914a91ff492735881150ddc8a79e",
"versionType": "git",
"status": "affected"
},
{
"version": "bfcd8d791ec18496772d117774398e336917f56e",
"lessThan": "c3faf548a00f4c17100cc9204746975fa46a73b9",
"versionType": "git",
"status": "affected"
}
]
},
{
"vendor": "Linux",
"product": "Linux",
"defaultStatus": "affected",
"programFiles": [
"drivers/net/ethernet/broadcom/bnxt/bnxt.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"versions": [
{
"version": "5.4",
"status": "affected"
},
{
"version": "0",
"lessThan": "5.4",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "5.10.265",
"lessThanOrEqual": "5.10.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "5.15.216",
"lessThanOrEqual": "5.15.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "6.1.183",
"lessThanOrEqual": "6.1.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "6.6.152",
"lessThanOrEqual": "6.6.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "6.12.114",
"lessThanOrEqual": "6.12.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "6.18.45",
"lessThanOrEqual": "6.18.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "7.1.9",
"lessThanOrEqual": "7.1.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "7.2",
"lessThanOrEqual": "*",
"versionType": "original_commit_for_fix",
"status": "unaffected"
}
]
}
]
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"availabilityImpact": "LOW"
},
"exploitabilityScore": 3.9,
"impactScore": 4.2
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"timestamp": "2026-10-16T19:14:48.095926Z",
"id": "CVE-2026-74697",
"options": [
{
"exploitation": "none"
},
{
"automatable": "yes"
},
{
"technicalImpact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
]
},
"references": [
{
"url": "https://git.kernel.org/stable/c/410da4428b1f47bf9a84bdc0bcaa089d73ba2048",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/68c181af7cd1ca9cbf29acd95911073bfd3c6397",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/7aee22a35978b44784612c156e358e375ddf5d16",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/927e2617a36f49752cb5613900ca21f40593f07d",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/aab3b5f4d8ec8598606ee011e219ef824ae25ca0",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/b61c4911204a0a2f900e538d64ceb608f6c9614d",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/c1962ab4645a914a91ff492735881150ddc8a79e",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/c3faf548a00f4c17100cc9204746975fa46a73b9",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
]
}