CVE-2026-99081— bnxt_en 驱动 DMA 映射越界漏洞
一分钟漏洞结论
影响对象
Linux Linux
利用判断
尚无明确在野利用证据，仍需结合暴露面评估
建议动作
优先检查厂商安全公告和参考链接中的修复版本；无法立即升级时，限制受影响服务暴露并加强监测。
在 Linux 内核中，以下漏洞已得到修复： bnxt_en：修复带填充的小数据包的 DMA 映射长度 Stefan Fleischmann 报告称，在 BCM57412 NetXtreme-E 网卡上通过 VLAN/macvlan 接口发送数据包时，Intel IOMMU 会触发 DMA 读错误： 错误地址（0xfc499000）恰好位于 4KB 页边界，表明发生了 DMA 读缓冲区溢出。 在 函数中，小于 （52 字节）的数据包（例如 42 字节的未标记 ARP 帧）会被填充： 然而，变量 在之前已被初始化为
可能的 ATT&CK 技术 1 AI
T1069 · Permission Groups Discovery
获取后续新漏洞提醒
登录后订阅
一、 漏洞 CVE-2026-99081 基础信息
漏洞信息
对漏洞内容有疑问？看看神龙的深度分析是否有帮助！
查看神龙十问 ↗
尽管我们使用了先进的大模型技术，但其输出仍可能包含不准确或过时的信息。神龙努力确保数据的准确性，但请您根据实际情况进行核实和判断。
Vulnerability Title
bnxt_en: fix DMA mapping length for padded small packets
来源: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved:
bnxt_en: fix DMA mapping length for padded small packets
Stefan Fleischmann reported Intel IOMMU DMA Read faults on BCM57412
NetXtreme-E NICs when transmitting packets on VLAN/macvlan interfaces:
DMAR: [DMA Read NO_PASID] Request device [18:00.0] fault addr 0xfc499000
[fault reason 0x06] PTE Read access is not set
bnxt_en 0000:18:00.0 eno1np0: Abandoning msg {0xb4 0x41a} len: 0 due to firmware status: 0x2000001
...
NETDEV WATCHDOG: eno1np0 (bnxt_en): transmit queue 0 timed out
The fault address (0xfc499000) is on an exact 4KB page boundary,
pointing to a DMA read buffer overrun.
In bnxt_start_xmit(), packets smaller than BNXT_MIN_PKT_SIZE (52 bytes),
such as 42-byte untagged ARP frames, are padded:
if (length < BNXT_MIN_PKT_SIZE) {
pad = BNXT_MIN_PKT_SIZE - length;
if (skb_pad(skb, pad))
goto tx_kick_pending;
length = BNXT_MIN_PKT_SIZE;
}
mapping = dma_map_single(&pdev->dev, skb->data, len, DMA_TO_DEVICE);
...
dma_unmap_len_set(tx_buf, len, len);
However, 'len' was initialized earlier to skb_headlen(skb) (e.g. 42 bytes)
and is left unadjusted after padding. Consequently, dma_map_single() and
dma_unmap_len_set() map and track only 42 bytes.
Later, the hardware TX buffer descriptor is programmed with the padded length:
txbd->tx_bd_len_flags_type =
cpu_to_le32(((len + pad) << TX_BD_LEN_SHIFT) | flags |
TX_BD_FLAGS_PACKET_END);
The NIC DMA engine is thus instructed to read 52 bytes from a region where
only 42 bytes were DMA-mapped. If skb->data ends near the boundary of a 4KB
page (within 'pad' bytes of the next page), the hardware DMA read overruns
into the unmapped adjacent page, triggering an IOMMU fault.
This issue was exposed after commit 447cbe95ebb9 ("vlan: fix skb_under_panic
and races when toggling HW VLAN offload") because reserving extra VLAN
headroom rounded LL_RESERVED_SPACE from 48 up to 64 bytes, shifting skb->data
offsets and potentially causing small frames to land right against page
boundaries.
Fix this by using skb_put_padto(skb, BNXT_MIN_PKT_SIZE) in
bnxt_start_xmit(), before skb_shinfo(skb)->nr_frags is sampled,
because padding might linearize the skb.
This ensures skb->len and skb_headlen(skb) reflect the padded size so
that dma_map_single() maps the full buffer and the descriptor length is
consistent. This also removes the temporary 'pad' variable and masking logic.
The padding is done after the SW USO branch, otherwise
bnxt_sw_udp_gso_xmit() would account the padding as UDP payload
and send it in extra segments.
Note that SW USO segments are still not padded: with IPv4, a segment
carrying less than 10 bytes of UDP payload (small gso_size, or a short
last segment) is sent as a frame shorter than BNXT_MIN_PKT_SIZE.
This is a separate issue, left for a followup patch.
来源: CVE Program / CVE List V5
CVSS Information
N/A
来源: CVE Program / CVE List V5
Vulnerability Type
N/A
来源: CVE Program / CVE List V5
受影响产品
二、漏洞 CVE-2026-99081 的公开POC
| # | POC 描述 | 源链接 | 神龙链接 |
|---|
AI 生成 POC
高级
未找到公开 POC。
登录以生成 AI POC三、漏洞 CVE-2026-99081 的情报信息
请登录查看更多情报信息。
CVE-2026-99081 其他参考 (5)
同批安全公告 · Linux · 2026-10-23 · 共 218 条
| CVE-2026-98937 | Linux 内核 perf 远程代码执行漏洞 | |
| CVE-2026-98950 | Linux kernel flow_dissector 整数截断漏洞 | |
| CVE-2026-98949 | Imagination DRM 驱动 remap() 函数引用及 vm_bo 处理漏洞 | |
| CVE-2026-98948 | Mellanox mlxsw 端口范围寄存器泄漏漏洞 | |
| CVE-2026-98947 | vsock 内存泄漏漏洞 | |
| CVE-2026-98946 | V3D 驱动运行时挂起中断禁用漏洞 | |
| CVE-2026-98945 | Steam HID 驱动解绑顺序漏洞 | |
| CVE-2026-98944 | Steam HID 注册重构漏洞 | |
| CVE-2026-98943 | Steam HID 驱动锁清理 | |
| CVE-2026-98942 | Linux 内核 sched_ext 远程代码执行漏洞 | |
| CVE-2026-98941 | ext4 加密 inode 大页启用逻辑漏洞 | |
| CVE-2026-98940 | Linux 内核 ASoC 组件越界读取漏洞 | |
| CVE-2026-98939 | Linux x86/mm 内存管理逻辑缺陷 | |
| CVE-2026-98938 | Rust IRQ 请求机制参数传递漏洞 | |
| CVE-2026-98926 | AMD Display 驱动 DPMS 电源管理漏洞 | |
| CVE-2026-98929 | macsec 在注册前初始化 SecY 的竞态条件漏洞 | |
| CVE-2026-98928 | KVM arm64 信息泄露漏洞 | |
| CVE-2026-98927 | KVM arm64 嵌套 MMU 数组生命周期漏洞 | |
| CVE-2026-98930 | KVM s390 中断注入漏洞 | |
| CVE-2026-98925 | Linux bpf sockmap 序列号重复计数漏洞 |
显示前 20 条，共 218 条。 查看全部 → →
IV. Related Vulnerabilities
V. Comments for CVE-2026-99081
暂无评论