CVE-2026-53177: Linux Kernel Privilege Escalation Flaw

CVE-2026-53177 Overview

CVE-2026-53177 is a NULL pointer dereference vulnerability in the Linux kernel's bnxt_en driver, which supports Broadcom NetXtreme-C/E network adapters. The flaw occurs during PCIe error recovery when a Root Port or Downstream Port detects errors and triggers recovery services on all subordinate devices, regardless of their administrative state. The .error_detected() callback bnxt_io_error_detected() calls bnxt_disable_int_sync(), which dereferences bp->bnapi to map completion rings to IRQs. Because bp->bnapi is allocated on NIC open and freed on NIC close, PCIe error recovery against a closed NIC dereferences a NULL pointer, resulting in a kernel crash.

Critical Impact
A PCIe error event on a system with a closed bnxt_en-managed NIC triggers a kernel NULL pointer dereference, leading to a denial-of-service condition.

Affected Products

Linux kernel versions containing the bnxt_en driver prior to the fix commits
Systems using Broadcom NetXtreme-C/E network adapters
Stable kernel branches receiving backports of the fix

Discovery Timeline

2026-06-25 - CVE-2026-53177 published to NVD
2026-06-25 - Last updated in NVD database

Technical Details for CVE-2026-53177

Vulnerability Analysis

The vulnerability resides in the PCIe Advanced Error Reporting (AER) recovery path implemented by the bnxt_en driver. When the PCIe subsystem detects an error on a Root Port or Downstream Port, the kernel invokes the .error_detected() callback on all subordinate devices. For bnxt_en, this callback is bnxt_io_error_detected(), which proceeds to disable and synchronize device interrupts via bnxt_disable_int_sync().

The interrupt disable routine calls bnxt_cp_num_to_irq_num() to translate completion ring numbers into IRQ numbers. This translation relies on the per-NAPI context array bp->bnapi. The array is allocated when the NIC transitions to the open state and is freed when the interface is closed. If a PCIe error occurs while the interface is down, the callback executes against a bp->bnapi pointer that is NULL, triggering an in-kernel NULL pointer dereference [CWE-476].

Root Cause

The root cause is the absence of a state check inside bnxt_io_error_detected(). The driver assumes interrupt resources are valid during error recovery, but the PCIe error handling subsystem does not respect the administrative state of subordinate devices. The fix adds a check that returns early when bp->bnapi is NULL before attempting to disable or synchronize IRQs.

Attack Vector

Triggering this defect requires a PCIe error condition on the bus hosting the network adapter, typically a hardware fault, link instability, or simulated AER event. A local attacker with privileges to inject AER errors through debug interfaces such as aer_inject could deliberately trigger the crash on a host with a closed bnxt_en interface. The result is a kernel oops or panic, depending on system configuration, leading to denial of service.

// No verified exploit code available - see referenced commits for the corrective patch logic.

Detection Methods for CVE-2026-53177

Indicators of Compromise

Kernel oops or panic traces referencing bnxt_disable_int_sync or bnxt_cp_num_to_irq_num in dmesg or /var/log/messages
AER error events in kernel logs immediately preceding a NULL pointer dereference
Unexpected host reboots on systems with Broadcom NetXtreme-C/E adapters in a down state

Detection Strategies

Inventory running kernel versions across Linux fleet and compare against the fixed commits referenced in git.kernel.org stable tree
Monitor /sys/kernel/debug/pcie_aer and AER counters for recurring errors on slots hosting bnxt_en devices
Correlate bnxt_en driver state transitions (ip link set down) with subsequent PCIe error events

Monitoring Recommendations

Forward kernel logs to a centralized logging system and alert on oops signatures matching bnxt_disable_int_sync
Track PCIe AER statistics over time to identify hardware instability that could trigger the recovery path
Audit kernel package versions against distribution security advisories that backport the fix

How to Mitigate CVE-2026-53177

Immediate Actions Required

Apply the kernel update from your Linux distribution once it includes one of the upstream fix commits
For self-built kernels, cherry-pick the fix from the linux-stable tree, for example Linux Kernel Commit 08e57d0 or Linux Kernel Commit 3884976
Restrict access to PCIe AER injection interfaces and debugfs to root-only on production hosts

Patch Information

The fix adds a NULL check on bp->bnapi before disabling and synchronizing IRQs in bnxt_io_error_detected(). Multiple stable kernel branches received backports. Refer to the upstream commits: 08e57d0, 1a418ad, 3884976, 580844a, 59c5a3e, 964b1c3, and d930276.

Workarounds

Keep bnxt_en interfaces administratively up where operationally acceptable to avoid the NULL bp->bnapi state
Disable PCIe AER on affected slots through kernel command line parameters such as pci=noaer where vendor support permits
Replace or service hardware that produces repeated PCIe errors to reduce the likelihood of triggering the recovery path

bash

# Verify the running kernel includes the bnxt_en NULL check fix
uname -r
modinfo bnxt_en | grep -E 'version|filename'
# Review recent AER events that could trigger the recovery path
dmesg | grep -iE 'aer|bnxt_en'