GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2026-23041 (GCVE-0-2026-23041)

Vulnerability from cvelistv5 – Published: 2026-02-04 16:00 – Updated: 2026-05-11 21:58
VLAI
Title
bnxt_en: Fix NULL pointer crash in bnxt_ptp_enable during error cleanup
Summary
In the Linux kernel, the following vulnerability has been resolved: bnxt_en: Fix NULL pointer crash in bnxt_ptp_enable during error cleanup When bnxt_init_one() fails during initialization (e.g., bnxt_init_int_mode returns -ENODEV), the error path calls bnxt_free_hwrm_resources() which destroys the DMA pool and sets bp->hwrm_dma_pool to NULL. Subsequently, bnxt_ptp_clear() is called, which invokes ptp_clock_unregister(). Since commit a60fc3294a37 ("ptp: rework ptp_clock_unregister() to disable events"), ptp_clock_unregister() now calls ptp_disable_all_events(), which in turn invokes the driver's .enable() callback (bnxt_ptp_enable()) to disable PTP events before completing the unregistration. bnxt_ptp_enable() attempts to send HWRM commands via bnxt_ptp_cfg_pin() and bnxt_ptp_cfg_event(), both of which call hwrm_req_init(). This function tries to allocate from bp->hwrm_dma_pool, causing a NULL pointer dereference: bnxt_en 0000:01:00.0 (unnamed net_device) (uninitialized): bnxt_init_int_mode err: ffffffed KASAN: null-ptr-deref in range [0x0000000000000028-0x000000000000002f] Call Trace: __hwrm_req_init (drivers/net/ethernet/broadcom/bnxt/bnxt_hwrm.c:72) bnxt_ptp_enable (drivers/net/ethernet/broadcom/bnxt/bnxt_ptp.c:323 drivers/net/ethernet/broadcom/bnxt/bnxt_ptp.c:517) ptp_disable_all_events (drivers/ptp/ptp_chardev.c:66) ptp_clock_unregister (drivers/ptp/ptp_clock.c:518) bnxt_ptp_clear (drivers/net/ethernet/broadcom/bnxt/bnxt_ptp.c:1134) bnxt_init_one (drivers/net/ethernet/broadcom/bnxt/bnxt.c:16889) Lines are against commit f8f9c1f4d0c7 ("Linux 6.19-rc3") Fix this by clearing and unregistering ptp (bnxt_ptp_clear()) before freeing HWRM resources.
Severity
No CVSS data available.
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: a60fc3294a377204664b5484e4a487fa124155da , < 0174d5466caefc22f03a36c43b2a3cce7e332627 (git)
Affected: a60fc3294a377204664b5484e4a487fa124155da , < 3358995b1a7f9dcb52a56ec8251570d71024dad0 (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.18
Unaffected: 0 , < 6.18 (semver)
Unaffected: 6.18.6 , ≤ 6.18.* (semver)
Unaffected: 6.19 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/broadcom/bnxt/bnxt.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "0174d5466caefc22f03a36c43b2a3cce7e332627",
              "status": "affected",
              "version": "a60fc3294a377204664b5484e4a487fa124155da",
              "versionType": "git"
            },
            {
              "lessThan": "3358995b1a7f9dcb52a56ec8251570d71024dad0",
              "status": "affected",
              "version": "a60fc3294a377204664b5484e4a487fa124155da",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/broadcom/bnxt/bnxt.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.18"
            },
            {
              "lessThan": "6.18",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.19",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.6",
                  "versionStartIncluding": "6.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19",
                  "versionStartIncluding": "6.18",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbnxt_en: Fix NULL pointer crash in bnxt_ptp_enable during error cleanup\n\nWhen bnxt_init_one() fails during initialization (e.g.,\nbnxt_init_int_mode returns -ENODEV), the error path calls\nbnxt_free_hwrm_resources() which destroys the DMA pool and sets\nbp-\u003ehwrm_dma_pool to NULL. Subsequently, bnxt_ptp_clear() is called,\nwhich invokes ptp_clock_unregister().\n\nSince commit a60fc3294a37 (\"ptp: rework ptp_clock_unregister() to\ndisable events\"), ptp_clock_unregister() now calls\nptp_disable_all_events(), which in turn invokes the driver\u0027s .enable()\ncallback (bnxt_ptp_enable()) to disable PTP events before completing the\nunregistration.\n\nbnxt_ptp_enable() attempts to send HWRM commands via bnxt_ptp_cfg_pin()\nand bnxt_ptp_cfg_event(), both of which call hwrm_req_init(). This\nfunction tries to allocate from bp-\u003ehwrm_dma_pool, causing a NULL\npointer dereference:\n\n  bnxt_en 0000:01:00.0 (unnamed net_device) (uninitialized): bnxt_init_int_mode err: ffffffed\n  KASAN: null-ptr-deref in range [0x0000000000000028-0x000000000000002f]\n  Call Trace:\n   __hwrm_req_init (drivers/net/ethernet/broadcom/bnxt/bnxt_hwrm.c:72)\n   bnxt_ptp_enable (drivers/net/ethernet/broadcom/bnxt/bnxt_ptp.c:323 drivers/net/ethernet/broadcom/bnxt/bnxt_ptp.c:517)\n   ptp_disable_all_events (drivers/ptp/ptp_chardev.c:66)\n   ptp_clock_unregister (drivers/ptp/ptp_clock.c:518)\n   bnxt_ptp_clear (drivers/net/ethernet/broadcom/bnxt/bnxt_ptp.c:1134)\n   bnxt_init_one (drivers/net/ethernet/broadcom/bnxt/bnxt.c:16889)\n\nLines are against commit f8f9c1f4d0c7 (\"Linux 6.19-rc3\")\n\nFix this by clearing and unregistering ptp (bnxt_ptp_clear()) before\nfreeing HWRM resources."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T21:58:51.518Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/0174d5466caefc22f03a36c43b2a3cce7e332627"
        },
        {
          "url": "https://git.kernel.org/stable/c/3358995b1a7f9dcb52a56ec8251570d71024dad0"
        }
      ],
      "title": "bnxt_en: Fix NULL pointer crash in bnxt_ptp_enable during error cleanup",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-23041",
    "datePublished": "2026-02-04T16:00:24.710Z",
    "dateReserved": "2026-01-13T15:37:45.944Z",
    "dateUpdated": "2026-05-11T21:58:51.518Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-23041",
      "date": "2026-09-15",
      "epss": "0.0015",
      "percentile": "0.0456"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-23041\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-02-04T16:16:19.563\",\"lastModified\":\"2026-06-17T10:20:45.650\",\"vulnStatus\":\"Deferred\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nbnxt_en: Fix NULL pointer crash in bnxt_ptp_enable during error cleanup\\n\\nWhen bnxt_init_one() fails during initialization (e.g.,\\nbnxt_init_int_mode returns -ENODEV), the error path calls\\nbnxt_free_hwrm_resources() which destroys the DMA pool and sets\\nbp-\u003ehwrm_dma_pool to NULL. Subsequently, bnxt_ptp_clear() is called,\\nwhich invokes ptp_clock_unregister().\\n\\nSince commit a60fc3294a37 (\\\"ptp: rework ptp_clock_unregister() to\\ndisable events\\\"), ptp_clock_unregister() now calls\\nptp_disable_all_events(), which in turn invokes the driver\u0027s .enable()\\ncallback (bnxt_ptp_enable()) to disable PTP events before completing the\\nunregistration.\\n\\nbnxt_ptp_enable() attempts to send HWRM commands via bnxt_ptp_cfg_pin()\\nand bnxt_ptp_cfg_event(), both of which call hwrm_req_init(). This\\nfunction tries to allocate from bp-\u003ehwrm_dma_pool, causing a NULL\\npointer dereference:\\n\\n  bnxt_en 0000:01:00.0 (unnamed net_device) (uninitialized): bnxt_init_int_mode err: ffffffed\\n  KASAN: null-ptr-deref in range [0x0000000000000028-0x000000000000002f]\\n  Call Trace:\\n   __hwrm_req_init (drivers/net/ethernet/broadcom/bnxt/bnxt_hwrm.c:72)\\n   bnxt_ptp_enable (drivers/net/ethernet/broadcom/bnxt/bnxt_ptp.c:323 drivers/net/ethernet/broadcom/bnxt/bnxt_ptp.c:517)\\n   ptp_disable_all_events (drivers/ptp/ptp_chardev.c:66)\\n   ptp_clock_unregister (drivers/ptp/ptp_clock.c:518)\\n   bnxt_ptp_clear (drivers/net/ethernet/broadcom/bnxt/bnxt_ptp.c:1134)\\n   bnxt_init_one (drivers/net/ethernet/broadcom/bnxt/bnxt.c:16889)\\n\\nLines are against commit f8f9c1f4d0c7 (\\\"Linux 6.19-rc3\\\")\\n\\nFix this by clearing and unregistering ptp (bnxt_ptp_clear()) before\\nfreeing HWRM resources.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\\n\\nbnxt_en: Correcci\u00f3n de un fallo por puntero NULL en bnxt_ptp_enable durante la limpieza de errores\\n\\nCuando bnxt_init_one() falla durante la inicializaci\u00f3n (p. ej., bnxt_init_int_mode devuelve -ENODEV), la ruta de error llama a bnxt_free_hwrm_resources() que destruye el pool de DMA y establece bp-\u0026gt;hwrm_dma_pool a NULL. Posteriormente, se llama a bnxt_ptp_clear(), que invoca a ptp_clock_unregister().\\n\\nDesde el commit a60fc3294a37 (\u0027ptp: rework ptp_clock_unregister() to disable events\u0027), ptp_clock_unregister() ahora llama a ptp_disable_all_events(), que a su vez invoca la funci\u00f3n de callback .enable() del controlador (bnxt_ptp_enable()) para deshabilitar los eventos PTP antes de completar el desregistro.\\n\\nbnxt_ptp_enable() intenta enviar comandos HWRM a trav\u00e9s de bnxt_ptp_cfg_pin() y bnxt_ptp_cfg_event(), ambas llaman a hwrm_req_init(). Esta funci\u00f3n intenta asignar memoria de bp-\u0026gt;hwrm_dma_pool, causando una desreferencia de puntero NULL:\\n\\n  bnxt_en 0000:01:00.0 (net_device sin nombre) (no inicializado): bnxt_init_int_mode err: ffffffed\\n  KASAN: desreferencia de puntero nulo en el rango [0x0000000000000028-0x000000000000002f]\\n  Traza de Llamadas:\\n   __hwrm_req_init (drivers/net/ethernet/broadcom/bnxt/bnxt_hwrm.c:72)\\n   bnxt_ptp_enable (drivers/net/ethernet/broadcom/bnxt/bnxt_ptp.c:323 drivers/net/ethernet/broadcom/bnxt/bnxt_ptp.c:517)\\n   ptp_disable_all_events (drivers/ptp/ptp_chardev.c:66)\\n   ptp_clock_unregister (drivers/ptp/ptp_clock.c:518)\\n   bnxt_ptp_clear (drivers/net/ethernet/broadcom/bnxt/bnxt_ptp.c:1134)\\n   bnxt_init_one (drivers/net/ethernet/broadcom/bnxt/bnxt.c:16889)\\n\\nLas l\u00edneas son contra el commit f8f9c1f4d0c7 (\u0027Linux 6.19-rc3\u0027)\\n\\nSolucione esto limpiando y desregistrando ptp (bnxt_ptp_clear()) antes de liberar los recursos HWRM.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/net/ethernet/broadcom/bnxt/bnxt.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"a60fc3294a377204664b5484e4a487fa124155da\",\"lessThan\":\"0174d5466caefc22f03a36c43b2a3cce7e332627\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"a60fc3294a377204664b5484e4a487fa124155da\",\"lessThan\":\"3358995b1a7f9dcb52a56ec8251570d71024dad0\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/net/ethernet/broadcom/bnxt/bnxt.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.18\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.18\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.6\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.19\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/0174d5466caefc22f03a36c43b2a3cce7e332627\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/3358995b1a7f9dcb52a56ec8251570d71024dad0\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-06-28T11:45:33+00:00",
      "cve": "CVE-2026-23041",
      "id": "CVE-2026-23041",
      "initial_release_date": "2026-02-04T00:00:00+00:00",
      "product_status:known_not_affected": "274",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: bnxt_en: Fix NULL pointer crash in bnxt_ptp_enable during error cleanup",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-23041.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-07-15T05:33:38Z",
      "cve": "CVE-2026-23041",
      "id": "CVE-2026-23041",
      "initial_release_date": "2026-02-05T00:25:58Z",
      "product_status:known_not_affected": "334",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-23041",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-23041.json",
      "version": "7"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.