PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-74697 Linux CVE debrief

The Linux kernel bnxt_en driver has a vulnerability that causes data corruption when EOP is enabled on AGG rings with TPA. This issue affects Linux kernel maintainers, Linux distribution maintainers, and users of Linux systems with bnxt_en devices. The vulnerability is resolved by disabling EOP on all chips when TPA is enabled. Defenders should verify exposure, apply patches, and monitor devices to prevent data corruption. The CVE record was published on 2026-08-22T15:32:59.073Z and has not been modified since then.

Vendor
Linux
Product
Unknown
CVSS
HIGH 8.2
CISA KEV
Not listed in stored evidence
Original CVE published
2026-08-22
Original CVE updated
2026-10-21
Advisory published
2026-08-22
Advisory updated
2026-10-21

Who should care

Linux kernel maintainers, Linux distribution maintainers, and users of Linux systems with bnxt_en devices should assess exposure and apply patches to prevent data corruption. Defenders should verify exposure, apply patches, and monitor devices to prevent data corruption. The vulnerability affects Linux kernel versions and configurations that have bnxt_en devices.

Why it matters

CVE-2026-74697 is a Linux kernel vulnerability in bnxt_en that causes data corruption when EOP is enabled on AGG rings with TPA. Defenders should verify exposure, apply patches, and monitor devices to prevent data corruption.

  • Verify Linux kernel versions and configurations for exposure to CVE-2026-74697
  • Apply patches or updates provided by Linux distributions to fix the bnxt_en data corruption issue
  • Monitor bnxt_en devices for signs of data corruption or unusual behavior

Technical summary

The Linux kernel bnxt_en driver has a vulnerability that causes data corruption when EOP is enabled on AGG rings with TPA. The issue is resolved by disabling EOP on all chips when TPA is enabled. This vulnerability affects Linux kernel versions and configurations that have bnxt_en devices. The CVE record and source item provide details on the Linux kernel vulnerability in bnxt_en that causes data corruption when EOP is enabled on AGG rings with TPA. Older chips (P5 and older) do not automatically disable RO when EOP is enabled.

Defensive priority

Linux kernel maintainers and users should prioritize verifying exposure and applying patches to prevent data corruption in bnxt_en devices.

Recommended defensive actions

  • Verify Linux kernel versions and configurations for exposure to CVE-2026-74697
  • Apply patches or updates provided by Linux distributions to fix the bnxt_en data corruption issue
  • Monitor bnxt_en devices for signs of data corruption or unusual behavior
  • Review compensating controls for exposed systems while remediation is scheduled and verified
  • Check relevant monitoring, detection, and logs for exposed assets that need extra review
  • Track exceptions, retest remediated assets, and close the item only after evidence is documented
  • Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and source item provide details on a Linux kernel vulnerability in bnxt_en that causes data corruption when EOP is enabled on AGG rings with TPA. The issue is resolved by disabling EOP on all chips when TPA is enabled.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-74697 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-74697

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-74697 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-74697

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • bnxt_en: Disable EOP for TPA on all chips to prevent data corruption

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/74xxx/CVE-2026-74697.json

    cve_program_cvelist_v5

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/68c181af7cd1ca9cbf29acd95911073bfd3c6397

    Supplemental source

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/7aee22a35978b44784612c156e358e375ddf5d16

    Supplemental source

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/410da4428b1f47bf9a84bdc0bcaa089d73ba2048

    Supplemental source

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/b61c4911204a0a2f900e538d64ceb608f6c9614d

    Supplemental source

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/927e2617a36f49752cb5613900ca21f40593f07d

    Supplemental source

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/aab3b5f4d8ec8598606ee011e219ef824ae25ca0

    Supplemental source

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/c1962ab4645a914a91ff492735881150ddc8a79e

    Supplemental source

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.