CVE-2026-74697— bnxt_en: Disable EOP for TPA on all chips to prevent data corruption
Quick assessment
Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
在 Linux 内核中，已修复以下漏洞： bnxt_en：在所有芯片上禁用 TPA 相关的 EOP，以防止数据损坏 在 AGG（聚合）环上启用 EOP（帧尾填充，End of frame padding）可能导致前一片段的尾部零填充与下一个片段的数据发生重叠。如果启用了宽松排序（Relaxed Ordering，RO），这些零填充可能会覆盖下一片段中的有效数据，从而导致数据损坏。较老的芯片（P5 及更早版本）在启用 EOP 时不会自动禁用 RO。在部分 ARM 系统上，已报告在使用启用 RO 的 57508（P5）
Possible ATT&CK Techniques 1 AI
T1499 · Endpoint Denial of ServiceAffected Version Matrix 16
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Linux | Linux | bfcd8d791ec18496772d117774398e336917f56e< 68c181af7cd1ca9cbf29acd95911073bfd3c6397 |
affected |
bfcd8d791ec18496772d117774398e336917f56e< 7aee22a35978b44784612c156e358e375ddf5d16 |
affected | ||
bfcd8d791ec18496772d117774398e336917f56e< 410da4428b1f47bf9a84bdc0bcaa089d73ba2048 |
affected | ||
bfcd8d791ec18496772d117774398e336917f56e< b61c4911204a0a2f900e538d64ceb608f6c9614d |
affected | ||
bfcd8d791ec18496772d117774398e336917f56e< aab3b5f4d8ec8598606ee011e219ef824ae25ca0 |
affected | ||
bfcd8d791ec18496772d117774398e336917f56e< c1962ab4645a914a91ff492735881150ddc8a79e |
affected | ||
bfcd8d791ec18496772d117774398e336917f56e< c3faf548a00f4c17100cc9204746975fa46a73b9 |
affected | ||
5.4 |
affected | ||
| … +8 more rows | |||
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-74697
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
bnxt_en: Disable EOP for TPA on all chips to prevent data corruption
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved:
bnxt_en: Disable EOP for TPA on all chips to prevent data corruption
EOP (End of frame padding) on the AGG ring may cause overlapping of
zero padding at the end of one segment with the next segment's data.
If Relaxed Ordering (RO) is enabled, the zero padding may overwrite
valid data in the next segment and corrupt the data. Older chips
(P5 and older) do not automatically disable RO when EOP is enabled.
On some ARM systems, data corruption was reported on 57508 (P5)
chips with RO enabled.
Always disable EOP on all chips on the AGG rings when TPA is enabled
to fix the data corruption.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Affected Products
II. Public POCs for CVE-2026-74697
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-74697
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-74697 (5)
Same Patch Batch · Linux · 2026-08-22 · 150 CVEs total
| CVE-2026-74705 | 10.0 CRITICAL | udp: fix potential use-after-free in tunnel segmentation |
| CVE-2026-74612 | 10.0 CRITICAL | veth: fix skb length accounting after XDP frag adjustment |
| CVE-2026-74611 | 9.8 CRITICAL | tls: rx: restore msg_iter before TLS 1.3 optimistic retry |
| CVE-2026-74591 | 9.8 CRITICAL | mm/filemap: __filemap_add_folio() restore index before retrying |
| CVE-2026-74688 | 9.8 CRITICAL | sctp: clear control chunk transport if it is being removed |
| CVE-2026-74597 | 9.8 CRITICAL | ip6_tunnel: clear skb2->cb[] in ip6ip6_err() |
| CVE-2026-74617 | 9.8 CRITICAL | dibs: initialise dibs->lock in dibs_dev_alloc() |
| CVE-2026-74628 | 9.8 CRITICAL | net/x25: fix use-after-free of the socket by its timers |
| CVE-2026-74616 | 9.8 CRITICAL | xdp: reject clones that overrun skb_shared_info tailroom |
| CVE-2026-74587 | 9.8 CRITICAL | sctp: fix use-after-free of cached ASCONF chunk |
| CVE-2026-74608 | 9.8 CRITICAL | smb: client: Fix use-after-free in cifs_try_adding_channels() |
| CVE-2026-74723 | 9.8 CRITICAL | btrfs: lzo: reject inline extents without valid headers |
| CVE-2026-74730 | 9.8 CRITICAL | NFS: Pin the 'struct nfs_server' during a FREE_STATEID call |
| CVE-2026-74727 | 9.8 CRITICAL | ovpn: skip rehash for peers already removed from by_id |
| CVE-2026-74586 | 9.8 CRITICAL | sctp: clear new_transport when removing a peer |
| CVE-2026-74662 | 9.8 CRITICAL | inet: frags: publish queues before arming timer |
| CVE-2026-74588 | 9.8 CRITICAL | sctp: keep chunk->transport in step with the list it is queued on |
| CVE-2026-74669 | 9.8 CRITICAL | ipvs: clear IPv4 options after rebasing tunnel ICMP errors |
| CVE-2026-74712 | 9.3 CRITICAL | vdpa/mlx5: Fix buffer length in create_direct_keys() |
| CVE-2026-74665 | 9.1 CRITICAL | net: fix skb length accounting after generic XDP frag adjustment |
Showing top 20 of 150 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same product: Linux
-
CVE-2026-80589
block: stop the timeout timer when releasing a never added d -
CVE-2026-80588
mptcp: reclaim forward-allocated memory on RX path errors -
CVE-2026-80587
mptcp: avoid combining some incoming suboptions -
CVE-2026-80586
mptcp: options: reset DSS fields in case of unexpected size -
CVE-2026-80585
mptcp: fastopen: only mark MPTFO subflows with SYN data
Same vendor: Linux
-
CVE-2026-80589
block: stop the timeout timer when releasing a never added d -
CVE-2026-80588
mptcp: reclaim forward-allocated memory on RX path errors -
CVE-2026-80587
mptcp: avoid combining some incoming suboptions -
CVE-2026-80586
mptcp: options: reset DSS fields in case of unexpected size -
CVE-2026-80585
mptcp: fastopen: only mark MPTFO subflows with SYN data
V. Comments for CVE-2026-74697
No comments yet