Executive brief
The bnxt Ethernet driver in the Linux kernel incorrectly passes a platform device to the hwmon (hardware monitoring) event notification function instead of the hardware monitoring device. This API misuse results in undefined behavior and can cause kernel crashes, affecting systems with Broadcom network adapters that perform thermal monitoring.
Technical details
The vulnerability is an API misuse in the bnxt_hwmon_notify_event() function within drivers/net/ethernet/broadcom/bnxt/bnxt_hwmon.c. The hwmon_notify_event() function expects the hardware monitoring device as its first parameter, but the bnxt driver was passing &bp->pdev->dev (the platform device) instead. This type mismatch results in undefined behavior and potential kernel crashes. The fix, available in upstream and stable kernels, corrects the call to pass bp->hwmon_dev instead. No authentication or user interaction is required; the issue may trigger automatically when thermal events occur on affected systems.
Affected products
- Linux Linux kernel Affected versions from introduction of thermal event handler (commit a19b4801457b0) to patched versions
Timeline
- 2026-09-17: disclosed
- 2026-08-22: patched: Upstream patch merged