CVE-2026-74269 Linux Kernel Memory Underflow in Broadcom bnxt Driver – Impact, Detection, and Patch

Executive Summary

CVE-2026-74269 is a memory underflow vulnerability in the Linux kernel’s Broadcom NetXtreme (bnxt) network driver that affects systems running eXpress Data Path (XDP) packet processing. When XDP programs expand packet headers using bpf_xdp_adjust_head(), the driver miscalculates memory addresses during socket buffer construction, causing out-of-bounds memory access. The result is immediate kernel panic and denial of service.

Key Facts:

• CVSS Score: 7.5 (High)
• Attack Vector: Local or Network (depending on XDP deployment)
• Primary Impact: Denial of Service via kernel crash
• Affected Hardware: Broadcom NetXtreme NICs (10GbE–200GbE)
• Status: Patch available; workarounds exist

This advisory helps infrastructure teams understand the vulnerability, assess their exposure, and implement fixes without requiring deep kernel expertise.

What Is CVE-2026-74269?

The Vulnerability at a Glance

CVE-2026-74269 is a CWE-191 integer underflow in the Broadcom bnxt network driver’s packet receive function. When the driver processes multi-page packets under XDP native mode, it performs an arithmetic operation that can result in a pointer pointing before the valid memory buffer. This causes the kernel to read or write to unmapped memory, triggering an immediate crash.

Technical trigger: The vulnerability occurs specifically in the bnxt_rx_multi_page_skb() function when:

1. A Broadcom NetXtreme NIC receives a packet
2. An XDP program calls bpf_xdp_adjust_head() to expand the packet header
3. The driver subtracts a fixed offset (258 bytes on x86_64) from a pointer that has already been adjusted by XDP
4. The resulting pointer underflows past the start of the valid buffer

Why This Matters for Your Systems

Scope of impact:

• Broadcom hardware users: If your infrastructure uses Broadcom NetXtreme NICs (common in data centers and cloud environments), you may be affected.
• XDP deployments: Systems running XDP-based load balancers, firewalls, or packet processors are at higher risk.
• Availability risk: A single malicious packet or legitimate XDP operation can crash the entire host.

Real-world scenarios:

• A cloud provider running XDP-based DDoS mitigation experiences unexpected kernel panics
• An on-premises load balancer crashes when processing traffic from a compromised network segment
• A containerized application using XDP for network policy enforcement becomes unstable

Who Is Affected

Affected Hardware and Drivers

Vulnerable hardware:

• Broadcom NetXtreme Gigabit Ethernet (1GbE)
• Broadcom NetXtreme II (10GbE)
• Broadcom NetXtreme III (25/40/50GbE)
• Broadcom NetXtreme-E (100/200GbE)

Affected driver: bnxt_en (Broadcom NetXtreme driver)

Not affected:

• Other Broadcom drivers (e.g., bnx2, bnx2x)
• Non-Broadcom NICs
• Systems not running XDP programs

Affected Linux Kernel Versions

The vulnerability exists in Linux kernel versions that include:

1. Native XDP support in the bnxt driver
2. Multi-page packet handling in page-mode receive operations

Approximate affected range: Linux 5.4 through 6.x (prior to patch integration)

Note: Exact versions vary by distribution. Enterprise distributions (RHEL, Ubuntu, SLES) may have backported the fix or the vulnerable code depending on their kernel version and patch status.

How to Check If You’re Vulnerable

Step 1: Verify the driver is loaded

lsmod | grep bnxt_en

If output appears, the driver is active.

Step 2: Check if XDP is enabled

ip link show dev <interface_name> | grep xdp

Replace <interface_name> with your NIC name (e.g., eth0, ens1). If output shows xdp with a program attached, XDP is active.

Step 3: Verify kernel version

uname -r

Cross-reference with your distribution’s security advisories for patch status.

Step 4: Check for the patch

grep -r "bnxt_sw_rx_bd.*offset" /lib/modules/$(uname -r)/kernel/drivers/net/ethernet/broadcom/bnxt/

If the offset field is present in the driver code, the patch is applied.

How the Vulnerability Works

The Technical Root Cause

The bnxt driver allocates socket buffers (skbs) for incoming packets using the napi_build_skb() function. This function requires a pointer to the start of the buffer and the buffer size.

Vulnerable code pattern:

napi_build_skb(data_ptr - bp->rx_offset, rxr->rx_page_size);

The driver subtracts a fixed offset (bp->rx_offset) from data_ptr to account for reserved space at the beginning of the buffer. However, when XDP programs modify the packet header, data_ptr is adjusted by the XDP subsystem before this subtraction occurs.

Memory Underflow Explained

On x86_64 systems, bp->rx_offset is calculated as:

bp->rx_offset = NET_IP_ALIGN + XDP_PACKET_HEADROOM
              = 2 bytes + 256 bytes
              = 258 bytes

Normal operation (no XDP adjustment):

• data_ptr points to the start of packet data
• Subtracting 258 bytes gives a valid pointer to reserved space
• Buffer construction succeeds

Vulnerable operation (with XDP head expansion):

• XDP program calls bpf_xdp_adjust_head(ctx, -256) to expand the header by 256 bytes
• This shifts data_ptr backward by 256 bytes
• The driver then subtracts another 258 bytes
• Result: data_ptr - 258 points to memory before the valid buffer start
• Kernel attempts to access unmapped or protected memory → crash

Why XDP Head-Grow Operations Trigger It

XDP programs use bpf_xdp_adjust_head() to:

• Add encapsulation headers (tunneling)
• Insert custom metadata
• Implement packet rewriting

When the adjustment is negative (expanding the header), the XDP subsystem moves the data pointer backward. The bnxt driver’s fixed offset subtraction doesn’t account for this dynamic adjustment, causing the underflow.

Attack Scenarios and Real-World Risk

Local Denial of Service via eBPF

Attacker profile: Local user with CAP_BPF or CAP_NET_ADMIN capabilities

Attack steps:

1. Attacker writes a simple eBPF program that attaches to a bnxt interface in XDP mode
2. Program calls bpf_xdp_adjust_head() with a negative offset
3. Attacker sends traffic to the interface (or waits for legitimate traffic)
4. Kernel crashes on first packet processed by the XDP program

Proof of concept:

SEC("xdp")
int crash_kernel(struct xdp_md *ctx) {
    bpf_xdp_adjust_head(ctx, -256);  // Expand header by 256 bytes
    return XDP_PASS;
}

Impact: Complete host unavailability; requires reboot to recover.

Remote Triggering Through Network Traffic

Attacker profile: Remote attacker with network access to the target

Prerequisites:

• Target system runs an XDP program that performs header adjustments (e.g., XDP-based load balancer, firewall, or tunnel endpoint)
• Attacker can send packets to the target

Attack steps:

1. Attacker sends crafted packets designed to trigger the XDP head-expansion code path
2. Legitimate XDP program processes the packet and calls bpf_xdp_adjust_head()
3. Kernel crashes

Real-world example:

• A cloud provider runs XDP-based DDoS mitigation that adds metadata headers to suspicious packets
• Attacker sends packets that trigger the metadata-addition logic
• Provider’s load balancer crashes, affecting all downstream services

Impact: Denial of service affecting all traffic through the compromised host.

Likelihood and Impact Assessment

Severity and CVSS Rating

CVSS v3.1 Score Breakdown

Overall Score: 7.5 (High)

Vector (Remote Network Attack):

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Vector (Local eBPF Attack):

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

(Slightly lower due to privilege requirement)

Why the Rating Matters

A CVSS score of 7.5 indicates:

• Immediate patching required for systems in production
• High priority in vulnerability management workflows
• Significant business impact if exploited (service downtime)

Potential for Code Execution

Can this lead to RCE? Unlikely, but not impossible.

Why RCE is improbable:

• The vulnerability causes an immediate kernel panic before arbitrary code execution
• Modern kernel memory protection (SMEP, SMAP) prevents exploitation of the underflow for code execution
• The crash occurs in the kernel’s memory management code, not in user-controllable data structures

Why RCE is theoretically possible:

• Depending on adjacent memory layout, an attacker might corrupt kernel data structures before the crash
• Sophisticated exploitation could potentially achieve limited code execution before the panic

Practical assessment: Treat this as a denial-of-service vulnerability with remote code execution as a low-probability secondary risk.

How to Detect This Vulnerability

Identifying Vulnerable Drivers

Method 1: Check driver version

ethtool -i <interface_name> | grep driver

Output example:

driver: bnxt_en
version: 1.10.2

Method 2: Inspect kernel module

modinfo bnxt_en | grep version

Method 3: Check for patch indicators

strings /lib/modules/$(uname -r)/kernel/drivers/net/ethernet/broadcom/bnxt/bnxt_en.ko | grep -i "offset"

If the offset field is present in the driver symbols, the patch is likely applied.

Log Monitoring and Kernel Panic Indicators

Vulnerable systems will show kernel panics with these signatures:

In /var/log/kern.log or dmesg output:

BUG: unable to handle page fault for address: 0xffff...
RIP: bnxt_rx_multi_page_skb+0x...
Call Trace:
  bnxt_rx_pkt+0x...
  bnxt_poll+0x...
  napi_poll+0x...

In systemd journal:

journalctl -b -p err | grep -i "bnxt\|page fault\|kernel panic"

Automated monitoring script:

#!/bin/bash
# Alert on bnxt-related kernel panics
dmesg | tail -100 | grep -E "bnxt_rx_multi_page_skb|page fault.*bnxt" && \
  echo "ALERT: Potential CVE-2026-74269 exploitation detected" | mail -s "Security Alert" admin@example.com

Testing for the Flaw

Method 1: Kernel self-tests (if available)

python3 -m unittest xdp.py test_xdp_native_adjust_head_grow_data

Expected result on vulnerable system: Kernel panic or test failure

Method 2: Manual XDP program test

# Compile a simple XDP program that triggers the vulnerability
clang -O2 -target bpf -c test_xdp.c -o test_xdp.o
# Load it on a bnxt interface
ip link set dev eth0 xdp obj test_xdp.o sec xdp
# Send test traffic
ping -c 1 <target>
# Check if system is still responsive
echo "System still up" || echo "System crashed"

Method 3: Check for patch in kernel source

grep -A 10 "struct bnxt_sw_rx_bd" /usr/src/linux/drivers/net/ethernet/broadcom/bnxt/bnxt.h | grep offset

If offset field is present, the patch is applied.

Patching and Remediation

Applying the Official Kernel Patch

Step 1: Identify your kernel version

uname -r

Step 2: Check if your distribution has released a patched kernel

• Red Hat / CentOS: Check RHSA advisories

  yum check-update kernel

• Ubuntu / Debian: Check security updates

  apt list --upgradable | grep linux-image

• SLES: Check SUSE security advisories

  zypper list-updates | grep kernel

Step 3: Apply the patch

For distributions with package updates:

# Red Hat / CentOS
yum update kernel
# Ubuntu / Debian
apt update && apt install linux-image-generic
# SLES
zypper update kernel-default

For manual kernel compilation:

# Download the patch from kernel.org or your distribution
cd /usr/src/linux
patch -p1 < bnxt-fix-head-underflow.patch
# Recompile the driver
make modules_prepare
make M=drivers/net/ethernet/broadcom/bnxt modules
# Install the new driver
make M=drivers/net/ethernet/broadcom/bnxt modules_install
# Reboot
reboot

Step 4: Verify the patch

# After reboot, confirm the patched driver is loaded
modinfo bnxt_en | grep version
dmesg | grep bnxt

Immediate Workarounds

Workaround 1: Disable Native XDP (Recommended)

Switch from native XDP to generic XDP mode:

# Remove native XDP program
ip link set dev eth0 xdp off
# Reload in generic mode (if needed)
ip link set dev eth0 xdp obj program.o sec xdp mode skb

Impact: Slight performance reduction (generic XDP is slower than native), but eliminates the vulnerability.

Workaround 2: Restrict eBPF Privileges

Prevent unprivileged users from loading eBPF programs:

# Disable unprivileged eBPF
sysctl -w kernel.unprivileged_bpf_disabled=1
# Make persistent
echo "kernel.unprivileged_bpf_disabled=1" >> /etc/sysctl.conf
sysctl -p

Impact: Reduces local attack surface; does not affect remote attacks via existing XDP programs.

Workaround 3: Disable XDP Entirely (Temporary)

If XDP is not critical:

# Unload the bnxt driver
modprobe -r bnxt_en
# Reload without XDP support (if available)
modprobe bnxt_en

Impact: Complete loss of XDP functionality; use only as a temporary measure.

Disabling Native XDP Temporarily

Step-by-step:

1. Identify active XDP programs:

   ip link show | grep -A 5 xdp

1. Remove the XDP program:

   ip link set dev eth0 xdp off

1. Verify removal:

   ip link show dev eth0 | grep xdp

(Should show no output)

1. If you need XDP functionality, reload in generic mode:

   ip link set dev eth0 xdp obj program.o sec xdp mode skb

1. Monitor performance:

   ethtool -S eth0 | grep -i drop

Mitigation Best Practices

Restricting eBPF Privileges

Principle: Limit who can load eBPF programs to trusted administrators.

Implementation:

1. Disable unprivileged eBPF:

   sysctl -w kernel.unprivileged_bpf_disabled=2

(Value 2 = completely disabled; value 1 = disabled for unprivileged users)

1. Restrict CAP_BPF capability:

   # Use AppArmor or SELinux to restrict CAP_BPF
   # Example AppArmor rule:
   deny capability bpf,

1. Audit eBPF program loading:

   auditctl -a always,exit -F arch=b64 -S bpf -F auid>=1000 -F auid!=-1 -k bpf_load

1. Monitor for unauthorized eBPF activity:

   bpftool prog list
   bpftool map list

Network Segmentation Strategies

Principle: Limit exposure of vulnerable systems to untrusted networks.

Implementation:

1. Isolate systems running XDP:

• Place XDP-enabled systems in a dedicated VLAN
• Restrict ingress traffic to known-good sources
• Use network ACLs to block suspicious traffic patterns

1. Implement DDoS protection upstream:

• Use cloud-based DDoS mitigation instead of on-host XDP
• Filter malicious traffic at the network edge
• Reduces load on vulnerable systems

1. Monitor network traffic:

   tcpdump -i eth0 -n 'tcp or udp' | head -100

Monitoring and Alerting

Real-time monitoring:

1. Kernel panic detection:

   # Alert on kernel panics
   journalctl -f | grep -i "panic\|oops\|bug"

1. XDP program monitoring:

   # Monitor XDP program activity
   bpftool prog stat

1. System stability metrics:

   # Monitor system uptime and crashes
   uptime
   dmesg | tail -20

Automated alerting:

#!/bin/bash
# Monitor for CVE-2026-74269 indicators
ALERT_EMAIL="security@example.com"
# Check for kernel panics
if dmesg | grep -q "bnxt_rx_multi_page_skb\|page fault"; then
    echo "CRITICAL: Potential CVE-2026-74269 exploitation detected" | \
      mail -s "Security Alert: CVE-2026-74269" "$ALERT_EMAIL"
fi
# Check for unpatched driver
if ! modinfo bnxt_en | grep -q "offset"; then
    echo "WARNING: bnxt driver may be unpatched" | \
      mail -s "Patch Status Alert" "$ALERT_EMAIL"
fi

Frequently Asked Questions

Does This Affect All Broadcom Drivers?

No. CVE-2026-74269 is specific to the bnxt driver’s bnxt_rx_multi_page_skb() function during multi-page packet processing in page-mode receive operations.

Other Broadcom drivers not affected:

• bnx2 (older NetXtreme II)
• bnx2x (NetXtreme II 10GbE)
• bnxt_en in skb-mode (non-page-mode) receive

Why only bnxt? The vulnerability exists because:

1. Only the bnxt driver uses the specific napi_build_skb() pattern with fixed offset subtraction
2. Only page-mode receive operations trigger the code path
3. Only XDP native mode causes the pointer adjustment that triggers the underflow

Can This Lead to Remote Code Execution?

Unlikely, but theoretically possible.

Why RCE is improbable:

• The kernel crashes immediately upon accessing invalid memory
• Modern kernel protections (SMEP, SMAP, CFI) prevent exploitation
• The vulnerability is a simple pointer underflow, not a memory corruption primitive

Why RCE is theoretically possible:

• Sophisticated attackers might corrupt kernel data structures before the crash
• Depending on memory layout, adjacent structures could be overwritten
• Kernel heap spraying techniques could position exploitable data

Practical recommendation: Treat this as a denial-of-service vulnerability. If you’re concerned about RCE, apply patches immediately and restrict network access to vulnerable systems.

How Does the Patch Fix the Issue?

The patch adds an explicit offset field to the bnxt_sw_rx_bd structure:

Before (vulnerable):

struct bnxt_sw_rx_bd {
    struct page *page;
    // No offset tracking
};
// Vulnerable calculation:
napi_build_skb(data_ptr - bp->rx_offset, size);

After (patched):

struct bnxt_sw_rx_bd {
    struct page *page;
    u16 offset;  // NEW: Track the true buffer offset
};
// Safe calculation:
frag_start = page_address(page) + offset;
napi_build_skb(frag_start, size);

How it works:

1. The offset field stores the true start of the buffer within the page
2. During packet processing, the driver uses offset directly instead of subtracting a fixed value
3. XDP adjustments don’t affect the base calculation, preventing underflow

What’s the Timeline for Patching?

Patch availability:

• Linux kernel: Patch merged into mainline (kernel.org)
• Red Hat: RHSA advisory issued; patches available via yum
• Ubuntu: Security update released; patches available via apt
• SLES: SUSE security advisory issued; patches available via zypper

Recommended timeline:
| Timeframe | Action |
|———–|——–|
| Immediate (0–7 days) | Assess exposure; apply workarounds if needed |
| Short-term (1–2 weeks) | Test patches in non-production environments |
| Medium-term (2–4 weeks) | Deploy patches to production systems |
| Long-term (1–3 months) | Verify all systems are patched; remove workarounds |

Factors affecting timeline:

• System criticality (production vs. development)
• Maintenance windows available
• Testing requirements
• Dependency on XDP functionality

Summary and Next Steps

Key takeaways:

1. CVE-2026-74269 is a high-severity denial-of-service vulnerability affecting Broadcom NetXtreme NICs running XDP
2. Exploitation is possible both locally (via eBPF) and remotely (via XDP programs)
3. Patches are available from all major Linux distributions
4. Workarounds exist for systems that cannot be patched immediately

Recommended actions:

1. Inventory: Identify systems using Broadcom NetXtreme NICs with XDP enabled
2. Assess: Determine patch status and exposure level
3. Prioritize: Focus on production systems and critical infrastructure
4. Patch: Apply kernel updates from your distribution
5. Verify: Confirm patches are applied and systems are stable
6. Monitor: Implement alerting for kernel panics and XDP activity

For additional support:

• Contact your Linux distribution’s security team
• Consult Broadcom’s security advisories
• Review kernel.org security announcements

References

• Linux Kernel Source: drivers/net/ethernet/broadcom/bnxt/bnxt.c
• Kernel Patch: “bnxt: fix head underflow on XDP head-grow” (kernel.org)
• eBPF/XDP Documentation: kernel.org BPF Documentation
• CVSS Calculator: CVSS v3.1 Specification
• CWE References:
• CWE-191: Integer Underflow
• CWE-119: Improper Restriction of Operations within Memory Bounds

Document Version: 1.0
Last Updated: 2024
Classification: Public
Feedback: security-advisories@example.com