Linux bnxt_en driver (XDP head-grow underflow): Head underflow when an XDP program grows the packet head on a Broadcom

Impact

Head underflow when an XDP program grows the packet head on a Broadcom NIC, crashing the host. Found by the kernel's own XDP test suite, which is a reminder that the XDP fast paths on vendor NIC drivers get materially less real-world coverage than the normal receive path — and AI-serving front-ends are one of the few places they run at scale.

Who can reach it

An attached XDP program that grows the packet head, processing received traffic.

What to do

Kernel/driver upgrade plus host reboot. Interim: detach head-growing XDP programs from Broadcom interfaces.

References

Related entries

• Linux kernel - SRP target (srpt), drivers/infiniband/ulp/srpt/ib_srpt.c: An integer overflow in the immediate-dataCVE-2026-74394 · Linux kernel - SRP target (srpt), drivers/infiniband/ulp/srpt/ib_srpt.cCritical
• Cisco Catalyst SD-WAN Manager: URI-encoding auth bypass gives unauthenticated admin API accessCVE-2026-76504 · Cisco Catalyst SD-WAN Manager (API session authentication, URI encoding handling)Critical
• FreeIPMI SEL parser: stack overflow on malformed Fujitsu iRMC long-text SEL responsesCVE-2026-85504 · FreeIPMI libfreeipmi SEL parser (Fujitsu iRMC OEM long-text records)Critical
• FreeIPMI ipmi-oem: stack overflow parsing Dell get-system-info responses returned by a BMCCVE-2026-85506 · FreeIPMI ipmi-oem (Dell get-system-info handlers)Critical
• FreeIPMI FRU reader: stack overflow when a BMC returns more FRU bytes than requestedCVE-2026-85509 · FreeIPMI libfreeipmi FRU reader (_read_fru_data)Critical
• Linux RDMA/rtrs-srv: unvalidated usr_len from the wire underflows data_len into an out-of-bounds lengthCVE-2026-97413 · Linux kernel RDMA/rtrs-srv (process_read/process_write usr_len validation)Critical