{"id":"CVE-2026-99081","kind":"vulnerability","aliases":["CVE-2026-99081"],"related":[],"title":"Linux bnxt_en driver: short-packet padding maps too few bytes, causing DMA faults","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nbnxt_en: fix DMA mapping length for padded small packets\n\nStefan Fleischmann reported Intel IOMMU DMA Read faults on BCM57412\nNetXtreme-E NICs when transmitting packets on VLAN/macvlan interfaces:\n\n  DMAR: [DMA Read NO_PASID] Request device [18:00.0] fault addr 0xfc499000\n        [fault reason 0x06] PTE Read access is not set\n  bnxt_en 0000:18:00.0 eno1np0: Abandoning msg {0xb4 0x41a} len: 0 due to firmware status: 0x2000001\n  ...\n  NETDEV WATCHDOG: eno1np0 (bnxt_en): transmit queue 0 timed out\n\nThe fault address (0xfc499000) is on an exact 4KB page boundary,\npointing to a DMA read buffer overrun.\n\nIn bnxt_start_xmit(), packets smaller than BNXT_MIN_PKT_SIZE (52 bytes),\nsuch as 42-byte untagged ARP frames, are padded:\n\n    if (length < BNXT_MIN_PKT_SIZE) {\n        pad = BNXT_MIN_PKT_SIZE - length;\n        if (skb_pad(skb, pad))\n            goto tx_kick_pending;\n        length = BNXT_MIN_PKT_SIZE;\n    }\n\n    mapping = dma_map_single(&pdev->dev, skb->data, len, DMA_TO_DEVICE);\n    ...\n    dma_unmap_len_set(tx_buf, len, len);\n\nHowever, 'len' was initialized earlier to skb_headlen(skb) (e.g. 42 bytes)\nand is left unadjusted after padding. Consequently, dma_map_single() and\ndma_unmap_len_set() map and track only 42 bytes.\n\nLater, the hardware TX buffer descriptor is programmed with the padded length:\n\n    txbd->tx_bd_len_flags_type =\n        cpu_to_le32(((len + pad) << TX_BD_LEN_SHIFT) | flags |\n                    TX_BD_FLAGS_PACKET_END);\n\nThe NIC DMA engine is thus instructed to read 52 bytes from a region where\nonly 42 bytes were DMA-mapped. If skb->data ends near the boundary of a 4KB\npage (within 'pad' bytes of the next page), the hardware DMA read overruns\ninto the unmapped adjacent page, triggering an IOMMU fault.\n\nThis issue was exposed after commit 447cbe95ebb9 (\"vlan: fix skb_under_panic\nand races when toggling HW VLAN offload\") because reserving extra VLAN\nheadroom rounded LL_RESERVED_SPACE from 48 up to 64 bytes, shifting skb->data\noffsets and potentially causing small frames to land right against page\nboundaries.\n\nFix this by using skb_put_padto(skb, BNXT_MIN_PKT_SIZE) in\nbnxt_start_xmit(), before skb_shinfo(skb)->nr_frags is sampled,\nbecause padding might linearize the skb.\nThis ensures skb->len and skb_headlen(skb) reflect the padded size so\nthat dma_map_single() maps the full buffer and the descriptor length is\nconsistent. This also removes the temporary 'pad' variable and masking logic.\n\nThe padding is done after the SW USO branch, otherwise\nbnxt_sw_udp_gso_xmit() would account the padding as UDP payload\nand send it in extra segments.\n\nNote that SW USO segments are still not padded: with IPv4, a segment\ncarrying less than 10 bytes of UDP payload (small gso_size, or a short\nlast segment) is sent as a frame shorter than BNXT_MIN_PKT_SIZE.\nThis is a separate issue, left for a followup patch.","summary":"In the Linux kernel's bnxt_en driver for Broadcom NetXtreme-E NICs, packets shorter than 52 bytes are padded but the DMA mapping covers only the original length, so the NIC reads past the mapped buffer. The result is IOMMU DMA faults, adapter errors and transmit queue timeouts, a denial of service rather than code execution.","severity":"low","cvss":null,"epss":0.00209,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["bnxt_en","broadcom","infrastructure","iommu","kernel","linux","macvlan","nic","vlan"],"not_affected_if":["no-bnxt-en-hardware","non-linux"],"how_to_check":"- Run `uname -r` and check whether the kernel predates the fix commit, which the sources do not name.\n- Run `lspci -nn | grep -i broadcom` to see whether a BCM57412 NetXtreme-E NIC is present.\n- Look in `dmesg` for `DMAR: [DMA Read NO_PASID]` faults or `bnxt_en` messages such as `Abandoning msg` and `transmit queue 0 timed out`.","fix":"- Update the Linux kernel to a release that includes the bnxt_en fix (the sources do not list the exact version: unknown).\n- Until patched, there is no workaround stated in the sources: unknown.","status":"open","published_at":"2026-10-23T13:17:32+00:00","first_seen_at":"2026-10-23T21:57:34+00:00","triaged_at":"2026-10-25T04:53:36+00:00","updated_at":"2026-10-25T12:38:50+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-10-25T04:53:36Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Linux kernel to a release that includes the bnxt_en fix (the sources do not list the exact version: unknown).\n- Until patched, there is no workaround stated in the sources: unknown.","reach":"local","title":"Linux bnxt_en driver: short-packet padding maps too few bytes, causing DMA faults","impact":"low","summary":"In the Linux kernel's bnxt_en driver for Broadcom NetXtreme-E NICs, packets shorter than 52 bytes are padded but the DMA mapping covers only the original length, so the NIC reads past the mapped buffer. The result is IOMMU DMA faults, adapter errors and transmit queue timeouts, a denial of service rather than code execution.","category":"infrastructure","nicknames":[],"who_cares":["linux","kernel","bnxt_en","broadcom","nic","vlan","macvlan","iommu"],"confidence":0.6,"needs_auth":"no","worst_case":"NIC transmit stalls and kernel logs DMA faults, causing a network outage","analyst_note":"Find the fixed kernel version and fix commit in the upstream kernel.org stable tree or the NVD entry; the sources give neither.","how_to_check":"- Run `uname -r` and check whether the kernel predates the fix commit, which the sources do not name.\n- Run `lspci -nn | grep -i broadcom` to see whether a BCM57412 NetXtreme-E NIC is present.\n- Look in `dmesg` for `DMAR: [DMA Read NO_PASID]` faults or `bnxt_en` messages such as `Abandoning msg` and `transmit queue 0 timed out`.","needs_analyst":true,"not_affected_if":["no-bnxt-en-hardware","non-linux"],"who_is_affected":"Hosts running Linux with a Broadcom bnxt_en NIC, such as BCM57412 NetXtreme-E, especially with VLAN or macvlan interfaces and an Intel IOMMU enabled. The fault needs small outbound frames such as ARP to land near a 4KB page boundary, which the sources describe as a result of a recent VLAN headroom change. Systems without bnxt_en hardware can skip it.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"low"},"cost_usd":0.000852,"input_tokens":4536,"output_tokens":797,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':17A,20A '-99081':18A,21A '0':162C,175C '00.0':138C,155C '0000':153C '0x06':144C '0x2000001':167C '0x41a':160C '0xb4':159C '0xfc499000':141C,181C '10':544C '18':137C,154C '42':211C,274C,295C,346C '447cbe95ebb9':390C '48':413C '4kb':186C,361C '52':49B,207C,339C '64':416C 'abandon':157C 'access':147C 'account':516C 'adapt':76B 'addr':140C 'address':180C 'adjac':378C 'also':491C 'arp':214C 'bcm57412':119C 'bd':311C,321C,326C 'bnxt':2A,22B,37B,100C,151C,171C,197C,203C,220C,225C,240C,441C,446C,510C,564C 'boundari':188C,358C,432C 'branch':508C 'broadcom':24B,41B 'buf':261C 'buffer':69B,194C,301C,483C 'byte':12A,50B,208C,212C,275C,296C,340C,347C,365C,417C,545C 'carri':541C 'caus':13A,424C 'code':88B 'commit':389C 'consequ':282C 'consist':489C 'cover':57B 'cpu':315C 'cve':16A,19A 'data':251C,354C,420C 'denial':83B 'descriptor':302C,486C 'dev':249C 'devic':136C,255C 'dma':14A,55B,74B,103C,115C,131C,192C,245C,253C,256C,283C,287C,332C,350C,372C,477C 'dma-map':349C 'dmar':130C 'done':503C 'driver':4A,39B 'due':163C 'e':44B,122C 'e.g':273C 'earlier':268C 'en':3A,23B,38B,101C,152C,172C 'end':329C,355C 'engin':333C 'eno1np0':156C,170C 'ensur':464C 'error':77B 'exact':185C 'execut':89B 'expos':387C 'extra':405C,526C 'fault':15A,75B,117C,139C,142C,179C,383C 'firmwar':165C 'fix':102C,392C,433C 'flag':313C,324C,327C 'fleischmann':111C 'follow':95C 'followup':576C 'frag':454C 'frame':215C,426C,561C 'full':482C 'goto':235C 'gso':513C,550C 'hardwar':299C,371C 'headlen':271C,469C 'headroom':407C 'howev':264C 'hw':400C 'infrastructur':25B 'initi':267C 'instruct':336C 'intel':113C 'interfac':129C 'iommu':26B,73B,114C,382C 'ipv4':538C 'issu':385C,572C 'kernel':27B,35B,93C 'kick':237C 'land':428C 'last':555C 'later':297C 'le32':317C 'left':278C,573C 'len':161C,252C,258C,262C,263C,265C,289C,312C,318C,322C,466C 'length':61B,105C,219C,229C,239C,308C,487C 'less':542C 'linear':460C 'linux':1A,28B,34B,92C 'll':409C 'logic':499C 'macvlan':29B 'map':9A,56B,68B,104C,244C,246C,284C,291C,351C,478C,480C 'mask':498C 'might':459C 'min':204C,221C,226C,241C,442C,565C 'msg':158C 'near':356C 'netdev':168C 'netxtrem':43B,121C 'netxtreme-':42B,120C 'next':368C 'nic':30B,45B,64B,123C,331C 'note':528C 'nr':453C 'offload':402C 'offset':421C 'origin':60B 'otherwis':509C 'overrun':195C,374C 'packet':7A,46B,109C,126C,200C,328C 'pad':8A,52B,107C,217C,224C,232C,234C,281C,307C,319C,364C,458C,473C,495C,501C,518C,536C 'padto':439C 'page':187C,362C,369C,379C,431C 'panic':395C 'pasid':134C 'past':66B 'patch':577C 'payload':521C,548C 'pdev':248C 'pend':238C 'pkt':205C,222C,227C,242C,443C,566C 'point':189C 'potenti':423C 'program':304C 'pte':145C 'put':438C 'queue':80B,174C 'race':397C 'rather':86B 'read':65B,116C,132C,146C,193C,338C,373C 'reason':143C 'reflect':471C 'region':343C 'remov':492C 'report':112C 'request':135C 'reserv':404C,410C 'resolv':99C 'result':71B 'right':429C 'round':408C 'sampl':456C 'segment':527C,532C,540C,556C 'send':523C 'sent':558C 'separ':571C 'servic':85B 'set':150C,259C,290C 'shift':323C,418C 'shinfo':451C 'short':6A,554C 'short-packet':5A 'shorter':47B,562C 'singl':247C,285C,479C 'size':206C,223C,228C,243C,444C,474C,551C,567C 'skb':231C,233C,250C,270C,272C,353C,393C,419C,437C,440C,450C,452C,462C,465C,468C,470C 'small':108C,425C,549C 'smaller':201C 'space':411C 'start':198C,447C 'status':166C 'stefan':110C 'still':534C 'sw':506C,511C,530C 'temporari':494C 'thus':335C 'time':176C 'timeout':81B 'toggl':399C 'track':293C 'transmit':79B,125C,173C 'trigger':380C 'tx':236C,260C,300C,310C,320C,325C 'txbd':309C 'type':314C 'udp':512C,520C,547C 'unadjust':279C 'unmap':257C,288C,377C 'untag':213C 'use':436C 'uso':507C,531C 'variabl':496C 'vlan':31B,391C,401C,406C 'vlan/macvlan':128C 'vulner':96C 'watchdog':169C 'within':363C 'would':515C 'xmit':199C,448C,514C","nicknames":[],"mitigations":[],"who_affected":"Hosts running Linux with a Broadcom bnxt_en NIC, such as BCM57412 NetXtreme-E, especially with VLAN or macvlan interfaces and an Intel IOMMU enabled. The fault needs small outbound frames such as ARP to land near a 4KB page boundary, which the sources describe as a result of a recent VLAN headroom change. Systems without bnxt_en hardware can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-23T13:17:32+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-99081","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-99081","severity":null,"published_at":"2026-10-23T13:17:32+00:00","modified_at":"2026-10-23T13:17:32+00:00","first_seen_at":"2026-10-23T21:57:34+00:00","fetched_at":"2026-10-23T22:29:03+00:00","note":null},{"source":"epss","external_id":"CVE-2026-99081","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-99081","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-25T12:38:50+00:00","fetched_at":"2026-10-25T12:38:50+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}