Executive brief
The Linux kernel's Broadcom network driver (bnxt_en) contains a flaw in how it handles TCP packet aggregation (TPA), a performance optimization that combines multiple network packets. When certain settings are enabled, padding data can overwrite valid packet content, corrupting network traffic and potentially breaking applications or causing data loss on servers using Broadcom network adapters.
Technical details
The vulnerability is a data corruption issue in the bnxt_en driver's TPA (Tagged Packet Aggregation) feature. When EOP (End of Packet padding) is enabled on the aggregation ring alongside Relaxed Ordering (RO), zero padding at the end of one network segment can overlap and overwrite valid data in the next segment. Older Broadcom chips (P5 and earlier) do not automatically disable RO when EOP is enabled, making them vulnerable. The issue manifests as silent data corruption on systems using affected chips (e.g., BCM57508). The fix disables EOP on all chips when TPA is enabled, preventing the padding-data collision. No authentication or user interaction is required; any network traffic using TPA can trigger the corruption. Patches are available in the Linux kernel stable tree.
Affected products
- Linux Linux kernel multiple versions containing bnxt_en driver (approximately 5.0 and later)
Timeline
- 2026-08-22: disclosed: CVE-2026-74697 published
- 2026-07-31: patched: Fix committed upstream (commit c3faf548a00f4c17100cc9204746975fa46a73b9)