CVE-2026-74745 Overview
CVE-2026-74745 is a denial-of-service vulnerability in the Linux kernel's Broadcom bnxt Ethernet driver. The flaw stems from a deadlock condition when the driver cancels its IRQ (Interrupt Request) affinity notifier. Unregistering an IRQ affinity notifier waits synchronously for the callback to complete. The bnxt driver acquires the netdev instance lock inside the notifier callback and also holds the same lock when canceling the work, creating a self-deadlock.
Critical Impact
Successful triggering of the deadlock hangs kernel worker threads tied to the network device, resulting in loss of network availability on systems using Broadcom NetXtreme adapters.
Affected Products
- Linux kernel bnxt Ethernet driver (Broadcom NetXtreme)
- Systems using Broadcom NIC hardware with IRQ affinity notifier and TPH (TLP Processing Hints) programming paths
- Distributions shipping the affected upstream kernel revisions prior to the referenced fixes
Discovery Timeline
- 2026-08-26 - CVE-2026-74745 published to NVD
- 2026-08-27 - Last updated in NVD database
Technical Details for CVE-2026-74745
Vulnerability Analysis
The vulnerability is a kernel deadlock [CWE-833] in the bnxt driver's IRQ affinity notifier handling. The affinity notifier restarts the receive queue in response to CPU affinity changes, and this restart path acquires the netdev instance lock. The driver's teardown or reconfiguration path holds that same lock while calling into the kernel API that unregisters the affinity notifier. Because unregistration synchronously waits for any in-flight notifier callback to finish, the callback cannot proceed until the lock is released, and the lock cannot be released until the callback finishes.
An attacker able to induce affinity change events, queue restarts, or TPH tag updates on a system with the affected driver can trigger the deadlock. The result is a hung network subsystem and impaired availability of the affected interface.
Root Cause
The root cause is an ordering violation between lock acquisition and synchronous cancellation of an asynchronous callback. The bnxt driver takes the netdev instance lock in the IRQ affinity notifier to restart the queue, but the same lock is held when canceling the notifier work. The fix moves the queue restart into the asynchronous service task, stores the new TPH tag, and schedules the task so cancellation no longer blocks on lock-holding code. The registration order in bnxt_request_irq() is also inverted so notifier registration, affinity setup, and initial TPH programming occur in a race-free sequence.
Attack Vector
The CVSS vector indicates a network-reachable availability impact. Exploitation requires the ability to trigger operations that invoke the affinity notifier and concurrent lock-holding paths on an affected system. There is no confidentiality or integrity impact. Refer to the upstream commits 51e96fa31f7e and 8b1118fc5a5d for the corrected sequencing.
Detection Methods for CVE-2026-74745
Indicators of Compromise
- Kernel hung_task warnings referencing bnxt worker threads or the netdev instance lock
- Stalled or unresponsive Broadcom NetXtreme network interfaces after IRQ affinity changes
- dmesg entries showing blocked tasks in irq_affinity_notify or queue restart paths
Detection Strategies
- Monitor kernel logs for soft lockup and hung task detector messages tied to bnxt symbols
- Compare running kernel versions and driver revisions against the upstream fix commits
- Correlate network interface flap events with concurrent IRQ affinity or TPH configuration changes
Monitoring Recommendations
- Enable kernel.hung_task_timeout_secs alerting and forward dmesg to a centralized log platform
- Track uptime and link-state metrics per interface to detect stalled queues early
- Alert on repeated ethtool or affinity reconfiguration failures on Broadcom NICs
How to Mitigate CVE-2026-74745
Immediate Actions Required
- Inventory hosts running the Broadcom bnxt driver and identify affected kernel builds
- Apply the upstream kernel patches referenced by commits 51e96fa31f7e and 8b1118fc5a5d or update to a distribution kernel that includes them
- Restrict unprivileged access to interfaces that trigger IRQ affinity or TPH reprogramming on affected hosts
Patch Information
The issue is resolved upstream by moving the queue restart to the asynchronous service task and inverting the registration order in bnxt_request_irq(). Apply distribution updates that incorporate the kernel commit 51e96fa31f7e and kernel commit 8b1118fc5a5d. Reboot after installation to load the fixed kernel image.
Workarounds
- Avoid dynamic IRQ affinity changes on Broadcom NetXtreme interfaces until the patched kernel is deployed
- Disable or pin irqbalance to a static configuration on affected hosts
- Where feasible, fail traffic over to a redundant NIC using a different driver during the maintenance window
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
