CVE-2026-80998

Status: UPDATED  |  Advisory ID: CVE-2026-80998

Key Details

Affected Products, Subsystems & Sectors

What to Know

In the Linux kernel, the following vulnerability has been resolved:

net: bnxt: ring the doorbell when SW USO exits early

When a burst of packets is handed down to the driver, the driver defers

the doorbell to the end by setting txr->kick_pending = 1. The normal TX

path handles this, but the SW USO path can miss it if it returns

early.

If bnxt_sw_udp_gso_xmit runs but returns early with NETDEV_TX_BUSY and

txr->kick_pending was previously set to 1, then the TX queue can

stall because the driver wrote some BDs but never wrote the doorbell.

The device won't know to do the TX which would generate the completion

that would wake the queue back up.

Simplify bnxt_sw_udp_gso_xmit to set txr->kick_pending in its success

case and check the flag on return. The added check after

bnxt_sw_udp_gso_xmit returns ensures that any pending doorbells are

written handling both successful USO and any early returns, which

prevents the TX queue stall mentioned above.

This TX queue stall was observed on a production system with a netdev TX

watchdog informing about the queue stall. (NVD)

What to Do

Monitor Linux's web page for any future patch releases.

References