GPU VulnDB

Database/Firmware, BMC & network fabric

Linux bnxt_en driver (RSS context delete logic): RSS contexts are not always freed in firmware when the driver deletes

CVE-2026-43260Firmware, BMC & network fabriccurated

Impact

RSS contexts are not always freed in firmware when the driver deletes them, leaving stale VNIC state on the adapter. Stale receive-steering state on a NIC is worth flagging in a multi-tenant context: RSS contexts and their VNICs determine which queues — and therefore which owner — receives which packets, and leaked contexts are exactly the kind of residue that should not survive a tenant teardown.

Who can reach it

Local, via repeated RSS context create/delete cycles from the host.

What to do

Kernel/driver upgrade plus host reboot. On bare-metal handoff, a cold power cycle of the NIC clears residual adapter state regardless of driver version — worth doing between tenants anyway.

References

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.