Linux bnxt_en driver (backing store type from firmware response): A second firmware-controlled-index bug in the same

Impact

A second firmware-controlled-index bug in the same driver: the backing-store type returned in a firmware response is stored and later used to index a fixed array. Same class as the DBG_BUF_PRODUCER issue and listed separately because it is fixed by a different commit — an operator matching only one CVE will still be running the other.

Who can reach it

The NIC firmware's response content.

What to do

Kernel/driver upgrade plus host reboot; same patch cycle as the other bnxt_en firmware-input issues.

References

Related entries

• Linux kernel (drivers/infiniband/hw/irdma): A tenant that asks for a user QP while declaring a zero-size work-queueCVE-2026-68418 · Linux kernel (drivers/infiniband/hw/irdma)Medium
• Linux kernel (drivers/net/ethernet/mellanox/mlx5/core/lib): Every memory-key allocation carrying a steering-tag hintCVE-2026-72006 · Linux kernel (drivers/net/ethernet/mellanox/mlx5/core/lib)Medium
• Dell OMSA: missing authentication on a critical function lets a local user crash the management agentCVE-2026-81441 · Dell OpenManage Server Administrator (OMSA) managed-node agentMedium
• Dell OMSA: partial string comparison flaw lets a low-privileged local user cause a denial of serviceCVE-2026-81479 · Dell OpenManage Server Administrator (OMSA) managed-node agentMedium
• Opengear console server (serial port logging): Stored XSS injected from a device *connected to* a serial portCVE-2019-14456 · Opengear console server (serial port logging)Medium
• AMD Secure Processor bootloader - SPIROM upgrade path: An attacker who can drive the SPIROM upgrade path can passCVE-2025-48515 · AMD Secure Processor bootloader - SPIROM upgrade pathMedium