CVE-2026-80998: Linux Kernel bnxt Driver DoS Vulnerability

CVE-2026-80998 Overview

CVE-2026-80998 is a denial-of-service vulnerability in the Linux kernel bnxt network driver for Broadcom NetXtreme adapters. The flaw resides in the software UDP Segmentation Offload (SW USO) transmit path. When bnxt_sw_udp_gso_xmit returns early with NETDEV_TX_BUSY while txr->kick_pending is set, the driver writes buffer descriptors (BDs) without ringing the device doorbell. The device never processes the pending transmit, no completion is generated, and the TX queue stalls until the netdev TX watchdog fires. The condition was observed on a production system through watchdog log messages reporting a stalled queue.

Critical Impact
A remote peer generating sustained UDP traffic bursts can trigger a transmit queue stall on affected Broadcom NIC deployments, disrupting network availability on the host.

Affected Products

Linux kernel bnxt_en driver (Broadcom NetXtreme-C/E series)
Linux distributions shipping the vulnerable bnxt SW USO transmit path
Systems using Broadcom NICs with software UDP GSO enabled

Discovery Timeline

2026-09-11 - CVE-2026-80998 published to NVD
2026-09-13 - Last updated in NVD database

Technical Details for CVE-2026-80998

Vulnerability Analysis

The bnxt driver batches transmit operations to reduce doorbell writes to the hardware. When packets arrive in a burst, the driver marks txr->kick_pending = 1 and defers ringing the doorbell until the end of the burst. The standard TX path correctly consumes this flag and issues the doorbell. The SW USO path does not.

When bnxt_sw_udp_gso_xmit encounters conditions that require an early return with NETDEV_TX_BUSY, control leaves the function while BDs are already written to the ring but the doorbell has not been rung. Because the device is never notified, it cannot process the descriptors or generate the transmit completion required to wake the queue. The queue enters a stalled state that persists until the netdev watchdog triggers a driver reset.

The attack vector is network-adjacent traffic patterns that induce SW USO early returns during a batched transmit sequence.

Root Cause

The root cause is a missing doorbell write on an early-return code path in bnxt_sw_udp_gso_xmit. The function does not honor the txr->kick_pending state on exit, breaking the invariant that any written BDs must be followed by a doorbell before the driver relinquishes the TX path. This is a state-management defect in the transmit fast path leading to a resource exhaustion condition on the affected queue.

Attack Vector

The vulnerability is reachable over the network without authentication or user interaction. UDP traffic patterns that keep the SW USO path active while forcing NETDEV_TX_BUSY conditions can drive the queue into the stalled state. The impact is confined to availability of the affected transmit queue on the host running the vulnerable bnxt driver.

No verified proof-of-concept code has been published. The upstream fix simplifies bnxt_sw_udp_gso_xmit to set txr->kick_pending on success and adds a check after the function returns so any pending doorbell is written on both successful and early-return paths. See the Linux Kernel Commit 48d1c96 and Linux Kernel Commit 4e15e89 for the patch details.

Detection Methods for CVE-2026-80998

Indicators of Compromise

Kernel log messages from the netdev TX watchdog reporting a transmit queue stall on a bnxt-managed interface.
Sudden loss of egress connectivity on one or more TX queues while receive traffic continues to flow.
ethtool -S <iface> counters showing halted tx_ucast_packets progress on a specific ring while kick_pending-related activity persists.

Detection Strategies

Monitor dmesg and journald for NETDEV WATCHDOG and transmit queue X timed out entries associated with Broadcom NetXtreme interfaces.
Correlate TX queue stalls with UDP burst workloads that exercise software segmentation offload paths.
Track kernel version and bnxt_en module version across the fleet to identify hosts running unpatched builds.

Monitoring Recommendations

Alert on repeated netdev watchdog resets for the same interface within a short window.
Ingest kernel and driver telemetry into a centralized data lake for cross-host correlation of queue-stall patterns.
Baseline UDP transmit throughput per queue and alert on sudden drops to zero while the interface remains administratively up.

How to Mitigate CVE-2026-80998

Immediate Actions Required

Inventory Linux hosts using the bnxt_en driver and identify kernels that predate the upstream fix.
Apply the upstream stable kernel update that includes commits 48d1c96 and 4e15e89 as soon as vendor builds are available.
Prioritize patching for hosts carrying UDP-heavy workloads such as VoIP media gateways, QUIC/HTTP3 servers, and video streaming systems.

Patch Information

The fix is present in the Linux kernel stable tree via Linux Kernel Commit 48d1c96 and Linux Kernel Commit 4e15e89. The patch simplifies bnxt_sw_udp_gso_xmit to set txr->kick_pending on the success path and adds a post-return check that flushes any pending doorbell, covering both successful transmits and early returns.

Workarounds

Disable software UDP GSO on affected interfaces using ethtool -K <iface> tx-udp-segmentation off where the workload permits, understanding potential throughput impact.
Where feasible, reduce reliance on large UDP GSO bursts by tuning application send patterns until the patched kernel is deployed.
Automate recovery by shortening watchdog timeout tolerances and scripting interface resets when a stall is detected, treating this only as a stopgap.

bash

# Configuration example
# Disable software UDP segmentation offload as a temporary workaround
ethtool -K eth0 tx-udp-segmentation off

# Verify the setting
ethtool -k eth0 | grep tx-udp-segmentation

# Confirm the running bnxt driver version
modinfo bnxt_en | grep -E '^(version|srcversion):'