CVE-2026-74697: Linux Kernel Information Disclosure Vulnerability

CVE-2026-74697 Overview

CVE-2026-74697 is a data integrity vulnerability in the Linux kernel's bnxt_en driver for Broadcom NetXtreme Ethernet controllers. The flaw resides in how the driver handles End of frame Padding (EOP) on the aggregation (AGG) ring when Transparent Packet Aggregation (TPA) is enabled. When Relaxed Ordering (RO) is active, zero padding at the end of one segment can overlap and overwrite valid data in the next segment, corrupting network payloads. The issue was observed on ARM systems using Broadcom 57508 (P5) chips with RO enabled. The kernel maintainers resolved the defect by unconditionally disabling EOP on the AGG rings when TPA is enabled across all supported chip generations.

Critical Impact
Silent, network-triggered data corruption of received traffic on affected Broadcom NIC hardware, with potential integrity impact on any workload consuming aggregated segments.

Affected Products

Linux kernel bnxt_en driver (multiple stable branches, per the referenced patches)
Broadcom NetXtreme P5 (57508) and older chip generations with TPA enabled
Systems using PCIe Relaxed Ordering (RO), notably ARM platforms

Discovery Timeline

2026-08-22 - CVE-2026-74697 published to NVD
2026-08-25 - Last updated in NVD database

Technical Details for CVE-2026-74697

Vulnerability Analysis

The bnxt_en driver supports Transparent Packet Aggregation (TPA), a hardware receive-side coalescing feature that combines multiple TCP segments into a single larger buffer before delivery to the network stack. Segments are placed onto an aggregation (AGG) ring. When End of frame Padding (EOP) is enabled on the AGG ring, the NIC writes zero padding bytes at the end of each segment to align buffers.

On PCIe transactions with Relaxed Ordering enabled, DMA writes are not guaranteed to complete in program order. As a result, the zero padding tail of one segment can be written after, and overlap with, the initial payload bytes of the following segment. This produces silent corruption of received data on the host without any hardware or driver error indication.

P5 and earlier chips do not automatically disable Relaxed Ordering when EOP is active, so the unsafe combination is reachable in normal operation. The maintainers' fix always disables EOP on the AGG rings when TPA is enabled, eliminating the race regardless of chip generation or RO setting.

Root Cause

The root cause is an unsafe interaction between hardware EOP zero-padding on the AGG ring and PCIe Relaxed Ordering. The driver enabled EOP for TPA without enforcing ordering guarantees on hardware that does not implicitly suppress RO in this mode, allowing DMA writes to overlap segment boundaries.

Attack Vector

The attack vector is network-adjacent traffic reception. Any host receiving traffic that exercises the TPA path on an affected NIC configuration can experience payload corruption. The condition is triggered by normal high-throughput receive workloads and does not require authenticated access, though intentional exploitation to bias specific corruption outcomes would require precise traffic shaping against a vulnerable configuration.

See the upstream fix in Linux kernel commit 68c181af and the backports listed in the references for technical details.

Detection Methods for CVE-2026-74697

Indicators of Compromise

Unexplained TCP checksum failures, application-layer integrity errors, or truncated payloads on hosts using Broadcom NetXtreme adapters with the bnxt_en driver.
Corruption clustered on hosts where TPA (GRO/LRO hardware offload) is enabled and PCIe Relaxed Ordering is active, particularly ARM platforms with 57508 NICs.
Elevated retransmission counters and application-level hash mismatches without corresponding NIC hardware error counters.

Detection Strategies

Inventory hosts running the bnxt_en driver and correlate kernel versions against the fixed commits referenced in the advisory.
Compare application-level checksums (for example, object storage ETags or file hashes) against source-of-truth values to identify silent receive-path corruption.
Use ethtool -k <iface> to enumerate rx-gro-hw / LRO state, and lspci -vv to inspect the RlxdOrd+ capability on the NIC's PCIe link.

Monitoring Recommendations

Track kernel version and driver module version fleet-wide, alerting when Broadcom NetXtreme hosts run pre-patch bnxt_en builds.
Monitor TCP retransmit rates, application checksum failures, and NIC ring statistics (ethtool -S) for anomalous spikes on affected hardware.
Ingest kernel and network telemetry into a centralized data lake to enable historical comparison across similar hardware classes.

How to Mitigate CVE-2026-74697

Immediate Actions Required

Apply the upstream Linux kernel patch or distribution update that includes the bnxt_en fix disabling EOP on AGG rings when TPA is enabled.
On ARM systems using 57508 (P5) NICs, prioritize patching where Relaxed Ordering is enabled, since these configurations have confirmed corruption reports.
Validate integrity of recently received data on affected hosts, especially long-lived transfers on TPA-enabled receive paths.

Patch Information

The fix is upstream in the Linux kernel and backported across multiple stable branches. Reference the following commits: 410da442, 68c181af, 7aee22a3, aab3b5f4, b61c4911, c1962ab4, and c3faf548. Rebuild custom kernels against these commits or install the corresponding distribution security update.

Workarounds

Disable hardware receive coalescing (TPA/LRO/GRO-HW) on affected interfaces using ethtool -K <iface> lro off and ethtool -K <iface> rx-gro-hw off until the patch is deployed.
Disable PCIe Relaxed Ordering for the affected NIC where the platform exposes a control, accepting the potential throughput reduction as a temporary trade-off.
Shift affected workloads to hosts running patched kernels or to NIC classes not implicated by the advisory.

bash

# Temporary mitigation: disable hardware receive coalescing on affected interface
sudo ethtool -K eth0 lro off
sudo ethtool -K eth0 rx-gro-hw off

# Verify current offload state
ethtool -k eth0 | grep -E 'large-receive-offload|rx-gro-hw'

# Inspect PCIe Relaxed Ordering state for the NIC
sudo lspci -vv -s <bdf> | grep -i RlxdOrd