CVE-2026-97574

A moderate impact flaw was found in the Linux kernel's Broadcom NetXtreme-E (bnxt_en) network driver in Red Hat Enterprise Linux 9 and 10, Red Hat In-Vehicle OS 2, and OpenShift Container Platform streams that ship an affected RHEL 9 or RHEL 10 based kernel. When the driver clones a receive ring during queue memory allocation, the clone retains pointers to the live ring's Transparent Packet Aggregation (TPA) state. If a subsequent memory allocation fails during a queue restart, the error-handling path can free the live ring's TPA memory while it is still in active use, leading to memory corruption and a kernel crash that results in a local denial of service. Exploiting this flaw requires local access with privileges to reconfigure the network device (such as CAP_NET_ADMIN) combined with a memory allocation failure at the right point in the queue restart, so the crash cannot be deterministically forced by an attacker. Earlier Red Hat Enterprise Linux 6, 7, and 8 releases, the RHEL 9.2, 9.4, 9.6, and 10.0 update streams, kernel-rt, and OpenShift Container Platform 4.12 through 4.21 are not affected because the vulnerable code is not present in those kernels. Red Hat's severity of Moderate (CVSS 3.1 score 5.5) is lower than the upstream assessment because the flaw is local, requires privileges, and depends on an unreliable allocation-failure condition. For the affected streams the fix is deferred to a future planned update; the residual risk is limited to a local denial of service on systems using affected Broadcom NetXtreme-E network hardware, with no confidentiality or integrity impact expected.