Executive brief
The Broadcom bnxt network driver in the Linux kernel has a flaw where the software UDP segmentation offload (USO) path can miss writing a device doorbell notification when exiting early, causing the transmit queue to stall. This prevents network packets from being sent, halting network communication on affected systems until the driver or kernel is restarted.
Technical details
The vulnerability is a logic error in the bnxt software UDP GSO transmit path (bnxt_sw_udp_gso_xmit). When the driver processes a burst of packets, it defers the doorbell write to signal the network device by setting txr->kick_pending = 1. If bnxt_sw_udp_gso_xmit returns early with NETDEV_TX_BUSY status while kick_pending remains set from a previous batch, the pending doorbell is never written. This leaves descriptor buffer descriptors (BDs) written but unaknowledged by the device, stalling the TX queue. The fix simplifies the USO function to defer the doorbell (setting kick_pending = 1) and adds a post-return check in bnxt_start_xmit to explicitly ring the doorbell when needed. The vulnerability affects the kernel's bnxt driver across multiple versions and was confirmed via netdev TX watchdog alerts in production.
Affected products
- Linux Linux kernel Multiple versions (bnxt driver)
Timeline
- 2026-09-11: disclosed
- 2026-08-21: patched