Medium severity · published Jun 25, 2026
CVE-2026-53177
bnxt_en: Fix NULL pointer dereference
5.5
CVSS
0.1%
EPSS
No
On KEV
Description
In the Linux kernel, the following vulnerability has been resolved:
bnxt_en: Fix NULL pointer dereference
PCIe errors detected by a Root Port or Downstream Port cause error
recovery services to run on all subordinate devices regardless of
administrative state.
The .error_detected() callback, bnxt_io_error_detected(), disables
and synchronizes IRQs via bnxt_disable_int_sync(), which calls
bnxt_cp_num_to_irq_num() to map completion rings to IRQs using
bp->bnapi.
Since bp->bnapi is allocated on NIC open and freed on NIC close, PCIe
error recovery on a closed NIC can dereference a NULL pointer.
Check if bp->bnapi is NULL before disabling and synchronizing IRQs.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.1% · higher than 2% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
KE
Kernel · Linux
4.17 before 5.15.210; 5.16 before 6.1.176; 6.2 before 6.6.143; 6.7 before 6.12.94; 6.13 before 6.18.36; 6.19 before 7.0.13; +7 more · source: NVD
LI
Linux · Linux
e5811b8c09df9bc80eabc95339fceded23f16289 before 1449177b87f768353909e930a99b902675119b2b; e5811b8c09df9bc80eabc95339fceded23f16289 before 964b1c3eb71afe58bb61c8b984164447e000ae8a; e5811b8c09df9bc80eabc95339fceded23f16289 before 59c5a3e69c7630a811565937e64be70b08436761; e5811b8c09df9bc80eabc95339fceded23f16289 before 1a418ad0e5e525d1d117dd1601681f75455af320; e5811b8c09df9bc80eabc95339fceded23f16289 before 08e57d014ea19f303d5d57a849beb846f37788b7; e5811b8c09df9bc80eabc95339fceded23f16289 before 3884976f87448e269908ae61bd5d62d54ce9c0c7; +3 more · source: vendor
SS
SIMATIC S7-1500 TM MFP - GNU/Linux subsystem · Siemens
0 · source: CISA
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-53177
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-53177
Patch
https://git.kernel.org/stable/c/08e57d014ea19f303d5d57a849beb846f37788b7
Patch
https://git.kernel.org/stable/c/1449177b87f768353909e930a99b902675119b2b
Patch
https://git.kernel.org/stable/c/1a418ad0e5e525d1d117dd1601681f75455af320
Patch
https://git.kernel.org/stable/c/3884976f87448e269908ae61bd5d62d54ce9c0c7
Patch
https://git.kernel.org/stable/c/580844a9683afe7974856dd5b7886447435b3474
Patch
https://git.kernel.org/stable/c/59c5a3e69c7630a811565937e64be70b08436761
More from Kernel
9.8
CVE-2025-39682
tls: fix handling of zero-length records on the rx_list
8.8
CVE-2026-53266
netfilter: bridge: make ebt_snat ARP rewrite writable
8.8
CVE-2013-6282
Linux Kernel Improper Input Validation Vulnerability
8.4
CVE-2022-0185
Linux Kernel Heap-Based Buffer Overflow Vulnerability
8.4
CVE-2013-2094
Linux Kernel Privilege Escalation Vulnerability
