CVE-2026-98356

What it actually does

The bnxt_re_init_dcb_wq function ignores a failed create_singlethread_workqueue allocation, leaving a NULL workqueue pointer that is later dereferenced by queue_work in the asynchronous DCB handler, causing a kernel NULL pointer dereference.

Why it matters to the business

Systems using the affected RDMA driver may experience kernel crashes or denial of service under normal DCB configuration flows, disrupting network and storage operations until the system is restarted or the driver is unloaded.

How an attack unfolds

An attacker with local access or the ability to trigger DCB events on a system running the vulnerable driver forces bnxt_re_init_dcb_wq to fail its workqueue allocation, then waits for the async handler to invoke queue_work on the resulting NULL pointer, crashing the kernel.

How to fix it

Update the Linux kernel to a version that adds the missing NULL check after create_singlethread_workqueue in bnxt_re_init_dcb_wq and returns an error instead of continuing with a NULL workqueue.

How to confirm the fix worked

Inspect the bnxt_re driver source for the presence of an explicit NULL check and error return after the create_singlethread_workqueue call; boot a patched kernel and confirm that DCB initialization failures no longer produce a NULL workqueue dereference.

Typical attack path

1. Obtain local execution or network position that can influence DCB events on the target host
2. Trigger or wait for bnxt_re_init_dcb_wq to attempt workqueue creation and fail
3. Invoke the asynchronous DCB handler path that calls queue_work on the uninitialized pointer
4. Observe kernel panic or memory corruption resulting from the NULL dereference

How to detect it

Review kernel logs for oops or panic messages referencing bnxt_re and queue_work or workqueue NULL dereference around the time of DCB-related events; correlate with driver load or interface configuration timestamps.

What your security team should do

• Prioritize kernel updates on any systems exposing the bnxt_re RDMA driver, especially those handling storage or high-performance networking traffic
• Monitor vendor advisories for the exact upstream commit and backported stable kernels
• Temporarily disable DCB or RDMA features on affected hardware if an immediate update is unavailable