Linux bnxt_en driver (backing store type from firmware response): A second firmware-controlled-index bug in the same

CVE-2026-43034Firmware, BMC & network fabriccurated

Impact

A second firmware-controlled-index bug in the same driver: the backing-store type returned in a firmware response is stored and later used to index a fixed array. Same class as the DBG_BUF_PRODUCER issue and listed separately because it is fixed by a different commit — an operator matching only one CVE will still be running the other.

Who can reach it

The NIC firmware's response content.

What to do

Kernel/driver upgrade plus host reboot; same patch cycle as the other bnxt_en firmware-input issues.

References

https://nvd.nist.gov/vuln/detail/CVE-2026-43034

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.