From mboxrd@z Thu Jan 1 00:00:00 1970 Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.remote-ip=100.103.45.18 ARC-Seal: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; cv=none; t=1792759460; b=1uyPV1Z9EYFt4FQfm1Ne/s01x3nxADnclTVH12TTZBxjXxv3a1a5kkj2+BocMT1vd0vZ XDEUhdnGkowEOhtL+D0eMXgyBtoIlHCqco+xv4hDli7fOhr+N/I/eCWM7r83z0dxCfZMJ lqFS2LxK28wi4lYDf/4gVZIha988SaGXiG5JMb+P7eq2QYCun7m6G4sps6bROdM8ATMdq 4JbuoTHnbFkaJQtbLFb5Yx2KTMWdvl/xHa2uv4fEIPj0mi6wG/lqo2F6L7Qe7IBr4n3o5 0sm+oDaey/q6qPPjU89t7o8ZRfidQT0H0xigNcIP+akyiIxIC5gmpNaL6hbkhEatJhA== ARC-Message-Signature: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; c=relaxed/relaxed; t=1792759460; h=Received:DKIM-Signature:From:To:Cc:Subject:Date:Message-ID:X-Mailer: Reply-To:MIME-Version:Lines:X-Developer-Signature:X-Developer-Key: Content-Transfer-Encoding; bh=1ns8HTB2aMulhSMAh00xqtnY2mV6HRbhezX+Ixu5ZMA=; b=X0M+T9lbWJekb5tmOIl25K/L8B/pT0TrpjqrYD2taOb7dbAwZ3pYJ1CqrSYdhfo63iSO CQ94N5fZby++unXC1He47a92Fwl5qu+H7cfxfWmd51FYPFvCjH3kQEaAR54aNO0L/1z3N Geu/vix2xq5NMjhLH1JE3oysGVpCoUBax0Kuc2H7QhXouPsAXXw0SaQcqhqFweHh/Lv8E z8cO7QQn6CN0wkSdrECueLtO6v28i94l8oSOk5/ghGJhWuiEXGBDnDa+EEUyiPpCHAgBr 7Jp77lpTOS4uTal/k4icBSRqiPSxsj2mq+WHE1582gLeVK1hKeXA//qgU7GNnp4S0ow== ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass header.d=linuxfoundation.org header.i=@linuxfoundation.org header.a=rsa-sha256 header.s=korg header.b=jGxDXDI+; arc=none smtp.remote-ip=100.103.45.18 Received: from smtp.kernel.org (quasi.space.kernel.org [100.103.45.18]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (prime256v1)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 25983606A31B for ; Fri, 23 Oct 2026 12:44:20 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key, unprotected) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.a=rsa-sha256 header.s=korg header.b=jGxDXDI+ Received: by smtp.kernel.org (Postfix) with ESMTPSA id 5753B1F01825; Fri, 23 Oct 2026 12:44:19 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1792759460; bh=1ns8HTB2aMulhSMAh00xqtnY2mV6HRbhezX+Ixu5ZMA=; h=From:To:Cc:Subject:Date:Reply-To; b=jGxDXDI+KxMMd7RVjl9xQoax5xHNArhWvm/1OMxdcN9VMyfEk8PSxqMJHDoJOSAXu F0gzUm8oKeSXKoQHAtGTfBh02GZsAPN0cCe47nba5EXgaTMtGLfnj3I5X1QbGKF6Y0 wwhXcjuorxGGDK+cM2gr0KJvKGwIucpSsLPdlHlE= From: Greg Kroah-Hartman To: linux-cve-announce@vger.kernel.org Cc: Greg Kroah-Hartman Subject: CVE-2026-99081: bnxt_en: fix DMA mapping length for padded small packets Date: Fri, 23 Oct 2026 14:21:23 +0200 Message-ID: <2026102336-CVE-2026-99081-e8cb@gregkh> X-Mailer: git-send-email 2.56.0 Reply-To: , X-Mailing-List: linux-cve-announce@vger.kernel.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 X-Developer-Signature: v=1; a=openpgp-sha256; l=5317; i=gregkh@linuxfoundation.org; h=from:subject:message-id; bh=qZRw7WsXowL2reQNgD7DZPC7WT5NWsyupVjnuk39sJs=; b=owGbwMvMwCRo6H6F97bub03G02pJDFm3A24cXu5pES3BfLiHVdkjMThrrXX7nyUscjKirJ+2Z 3vda8jviGVhEGRikBVTZPmyjefo/opDil6Gtqdh5rAygQxh4OIUgIkoZzIsaBPSlfH0kl7W3l7Q eczw4uXCDZWHGBbsjo0/Hz+NPerl+9ZZlz9tXc2kqJ0KAA== X-Developer-Key: i=gregkh@linuxfoundation.org; a=openpgp; fpr=F4B60CC5BF78C2214A313DCB3147D40DDB2DFB29 Content-Transfer-Encoding: 8bit From: Greg Kroah-Hartman Description =========== In the Linux kernel, the following vulnerability has been resolved: bnxt_en: fix DMA mapping length for padded small packets Stefan Fleischmann reported Intel IOMMU DMA Read faults on BCM57412 NetXtreme-E NICs when transmitting packets on VLAN/macvlan interfaces: DMAR: [DMA Read NO_PASID] Request device [18:00.0] fault addr 0xfc499000 [fault reason 0x06] PTE Read access is not set bnxt_en 0000:18:00.0 eno1np0: Abandoning msg {0xb4 0x41a} len: 0 due to firmware status: 0x2000001 ... NETDEV WATCHDOG: eno1np0 (bnxt_en): transmit queue 0 timed out The fault address (0xfc499000) is on an exact 4KB page boundary, pointing to a DMA read buffer overrun. In bnxt_start_xmit(), packets smaller than BNXT_MIN_PKT_SIZE (52 bytes), such as 42-byte untagged ARP frames, are padded: if (length < BNXT_MIN_PKT_SIZE) { pad = BNXT_MIN_PKT_SIZE - length; if (skb_pad(skb, pad)) goto tx_kick_pending; length = BNXT_MIN_PKT_SIZE; } mapping = dma_map_single(&pdev->dev, skb->data, len, DMA_TO_DEVICE); ... dma_unmap_len_set(tx_buf, len, len); However, 'len' was initialized earlier to skb_headlen(skb) (e.g. 42 bytes) and is left unadjusted after padding. Consequently, dma_map_single() and dma_unmap_len_set() map and track only 42 bytes. Later, the hardware TX buffer descriptor is programmed with the padded length: txbd->tx_bd_len_flags_type = cpu_to_le32(((len + pad) << TX_BD_LEN_SHIFT) | flags | TX_BD_FLAGS_PACKET_END); The NIC DMA engine is thus instructed to read 52 bytes from a region where only 42 bytes were DMA-mapped. If skb->data ends near the boundary of a 4KB page (within 'pad' bytes of the next page), the hardware DMA read overruns into the unmapped adjacent page, triggering an IOMMU fault. This issue was exposed after commit 447cbe95ebb9 ("vlan: fix skb_under_panic and races when toggling HW VLAN offload") because reserving extra VLAN headroom rounded LL_RESERVED_SPACE from 48 up to 64 bytes, shifting skb->data offsets and potentially causing small frames to land right against page boundaries. Fix this by using skb_put_padto(skb, BNXT_MIN_PKT_SIZE) in bnxt_start_xmit(), before skb_shinfo(skb)->nr_frags is sampled, because padding might linearize the skb. This ensures skb->len and skb_headlen(skb) reflect the padded size so that dma_map_single() maps the full buffer and the descriptor length is consistent. This also removes the temporary 'pad' variable and masking logic. The padding is done after the SW USO branch, otherwise bnxt_sw_udp_gso_xmit() would account the padding as UDP payload and send it in extra segments. Note that SW USO segments are still not padded: with IPv4, a segment carrying less than 10 bytes of UDP payload (small gso_size, or a short last segment) is sent as a frame shorter than BNXT_MIN_PKT_SIZE. This is a separate issue, left for a followup patch. The Linux kernel CVE team has assigned CVE-2026-99081 to this issue. Affected and fixed versions =========================== Issue introduced in 4.4 with commit c0c050c58d840994ba842ad1c338a98e7c12b764 and fixed in 6.6.160 with commit cf8530a25ae92c4493e2f22981ecb46f0b66f4c8 Issue introduced in 4.4 with commit c0c050c58d840994ba842ad1c338a98e7c12b764 and fixed in 6.12.113 with commit 2956aca14dd2977cd08bd2ccafae3beb8b84b268 Issue introduced in 4.4 with commit c0c050c58d840994ba842ad1c338a98e7c12b764 and fixed in 6.18.57 with commit fbd977e513971ccb4f0762a7f59eac500e474f89 Issue introduced in 4.4 with commit c0c050c58d840994ba842ad1c338a98e7c12b764 and fixed in 7.2.11 with commit 5213f65a9667d3dd85db2e6df8f2e0516290db34 Issue introduced in 4.4 with commit c0c050c58d840994ba842ad1c338a98e7c12b764 and fixed in 7.3 with commit a51d233ccd4889aadb71dace863525cc2b00271e Please see https://www.kernel.org for a full list of currently supported kernel versions by the kernel community. Unaffected versions might change over time as fixes are backported to older supported kernel versions. The official CVE entry at https://cve.org/CVERecord/?id=CVE-2026-99081 will be updated if fixes are backported, please check that for the most up to date information about this issue. Affected files ============== The file(s) affected by this issue are: drivers/net/ethernet/broadcom/bnxt/bnxt.c Mitigation ========== The Linux kernel CVE team recommends that you update to the latest stable kernel version for this, and many other bugfixes. Individual changes are never tested alone, but rather are part of a larger kernel release. Cherry-picking individual commits is not recommended or supported by the Linux kernel community at all. If however, updating to the latest release is impossible, the individual changes to resolve this issue can be found at these commits: https://git.kernel.org/stable/c/cf8530a25ae92c4493e2f22981ecb46f0b66f4c8 https://git.kernel.org/stable/c/2956aca14dd2977cd08bd2ccafae3beb8b84b268 https://git.kernel.org/stable/c/fbd977e513971ccb4f0762a7f59eac500e474f89 https://git.kernel.org/stable/c/5213f65a9667d3dd85db2e6df8f2e0516290db34 https://git.kernel.org/stable/c/a51d233ccd4889aadb71dace863525cc2b00271e