Executive brief
The Broadcom bnxt Ethernet driver in the Linux kernel has a deadlock vulnerability in its interrupt affinity handling code. When the driver unregisters IRQ affinity notifiers, it waits synchronously while holding a network device lock, and the notifier callback itself tries to acquire the same lock to restart the network queue. This creates a deadlock condition that can cause system hangs or service interruptions on affected network interfaces.
Technical details
The vulnerability is a classic lock-ordering deadlock in the bnxt driver's IRQ affinity callback (bnxt_irq_affinity_notify). The function acquires the netdev lock and then calls netdev_rx_queue_restart() while holding it. When IRQ affinity notifiers are unregistered during driver shutdown or reconfiguration, the unregistration waits synchronously for the callback to complete. If the callback is invoked concurrently, the lock acquire causes a deadlock. The fix moves queue restart operations to an asynchronous service task, storing the new TPH (Transaction Processing Hint) tag and scheduling deferred work instead of performing blocking operations under the netdev lock. Affected kernels include those with the TPH support feature (introduced in commit c214410c47d6), and the fix is available in upstream and stable kernel branches.
Affected products
- Linux Linux kernel affected versions include kernels with bnxt TPH support; patch available in mainline and stable branches
Timeline
- 2026-08-26: disclosed: CVE published
- 2026-08-03: patched: Upstream kernel fix by Jakub Kicinski (commit 51e96fa31f7e7eac2cba8f854e24d36600cc040b)
- 2026-08-23: patched: Backported to stable kernel branches