CVE-2026-43260

High · 7.8

CVSS

7.8

EPSS

0.1%

Published

May 6, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A driver bug can silently break network traffic balancing on certain servers after the network cable is unplugged and replugged, hurting speed until the system is fixed.

Exploitation: Local Privilege
Attacker needs: Low Privilege
Complexity: Low
Impact: Full Compromise
Component: OS kernel
Class: Memory Corruption
Remediation: Upgrade
Effort: Medium
Patch risk: Low

What it actually does

Incorrect netif_running() guard during RSS context deletion in bnxt_en driver leaks VNIC resources in firmware; subsequent open attempts then fail to allocate required contexts, causing loss of active RSS state.

Why it matters to the business

Network receive-side scaling stops working on affected systems after interface flaps, degrading performance for high-throughput workloads and potentially requiring reboots to restore full functionality.

How an attack unfolds

An attacker with local access repeatedly brings the interface down while RSS contexts are active, triggering the leak; on next open the driver requests unreserved VNICs that firmware rejects, leaving RSS disabled.

How to fix it

Apply the upstream fix that removes the netif_running() check when deleting RSS contexts; rebuild and deploy the corrected kernel image on all affected hosts.

How to confirm the fix worked

Confirm the patch is present by inspecting the bnxt_en RSS delete path for absence of the netif_running() condition; test interface close/open cycles with active RSS contexts and verify no VNIC allocation failures occur in firmware logs.

Typical attack path

Obtain local unprivileged access on a system using bnxt_en
Create or ensure active RSS contexts exist
Trigger repeated ifconfig down/up or equivalent close/open sequences
Observe driver attempting extra VNIC allocations that firmware denies
RSS contexts become unavailable, disrupting load-balanced receive traffic

How to detect it

Review dmesg and firmware logs for repeated HWRM RSS context allocation failures following interface down events; correlate with bnxt_en driver messages about VNIC reservation exhaustion.

What your security team should do

Prioritize kernel updates on all systems using Broadcom NetXtreme-E adapters
Monitor for RSS-related firmware errors after interface events
Limit local user ability to toggle interfaces on production systems until patched

The record

In the Linux kernel, the following vulnerability has been resolved: bnxt_en: Fix RSS context delete logic We need to free the corresponding RSS context VNIC in FW everytime an RSS context is deleted in driver. Commit 667ac333dbb7 added a check to delete the VNIC in FW only when netif_running() is true to help delete RSS contexts with interface down. Having that condition will make the driver leak VNICs in FW whenever close() happens with active RSS contexts. On the subsequent open(), as part of RSS context restoration, we will end up trying to create extra VNICs for which we did not make any reservation. FW can fail this request, thereby making us lose active RSS contexts. Suppose an RSS context is deleted already and we try to process a delete request again, then the HWRM functions will check for validity of the request and they simply return if the resource is already freed. So, even for delete-when-down cases, netif_running() check is not necessary. Remove the netif_running() condition check when deleting an RSS context.

Affected packages

Ecosystem	Package	Introduced	Fixed