PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-99081 Linux CVE debrief

A vulnerability in the Linux kernel's bnxt_en driver can cause DMA read buffer overruns when transmitting small packets on VLAN or macvlan interfaces. This issue arises when packets smaller than the minimum packet size are padded, but the DMA mapping length is not adjusted accordingly. The bnxt_en driver does not properly account for the padding added to small packets, leading to a mismatch between the actual packet size and the DMA mapping length. This can result in DMA read buffer overruns, potentially causing network connectivity issues. Defenders should assess exposure and prioritize patching affected Linux kernel versions.

Vendor
Linux
Product
Unknown
CVSS
HIGH 7.5
CISA KEV
Not listed in stored evidence
Original CVE published
2026-10-23
Original CVE updated
2026-10-30
Advisory published
2026-10-23
Advisory updated
2026-10-30

Who should care

Defenders responsible for Linux kernel infrastructure, particularly those using the bnxt_en driver, should assess exposure and prioritize patching affected versions. This includes Linux kernel developers, security teams, and system administrators who manage Linux-based systems that utilize the bnxt_en driver. Additionally, operators of systems that rely on the bnxt_en driver for network connectivity should be aware of the potential risks and take steps to

Why it matters

The CVE-2026-99081 vulnerability in the Linux kernel's bnxt_en driver can cause DMA read buffer overruns, potentially leading to network connectivity issues. Defenders should prioritize verifying and applying patches for affected Linux kernel versions.

  • Potential DMA read buffer overruns may cause network connectivity issues
  • Verification of Linux kernel versions and bnxt_en driver usage is necessary
  • Patching affected versions can prevent potential issues
  • Further analysis is required to determine the full scope of affected systems

Technical summary

The bnxt_en driver in the Linux kernel does not properly adjust the DMA mapping length for small packets that are padded to meet the minimum packet size requirement. This can lead to DMA read buffer overruns when transmitting packets on VLAN or macvlan interfaces. The issue arises from the driver's failure to update the DMA mapping length after padding small packets, resulting in a mismatch between the actual packet size and the DMA mapping length. This vulnerability can be exploited to cause network connectivity issues.

Defensive priority

Defenders should prioritize verifying and applying patches for Linux kernel versions affected by this vulnerability, particularly those using the bnxt_en driver.

Recommended defensive actions

  • Verify Linux kernel versions for bnxt_en driver usage
  • Apply patches for affected Linux kernel versions
  • Monitor for potential DMA read buffer overruns
  • Review VLAN and macvlan interface configurations
  • Perform vulnerability scanning to identify exposed systems
  • Implement compensating controls for exposed systems
  • Track patching progress and verify remediation

Evidence notes

The CVE record and source item provide details on the vulnerability, including its description, affected versions, and references to patches. However, the corpus does not establish specific exploitation instances or impacts.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-99081 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-99081

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-99081 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-99081

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • bnxt_en: fix DMA mapping length for padded small packets

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/99xxx/CVE-2026-99081.json

    cve_program_cvelist_v5

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/0f347e00d060dc0bf3b2d0ee041206e54848c233

    Supplemental source

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/b3fd0177cf18a6ac98d41af80b4040010ea40f4d

    Supplemental source

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/3a5d8465e73aff3c7d1ec38261dcaaa317367467

    Supplemental source

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/cf8530a25ae92c4493e2f22981ecb46f0b66f4c8

    Supplemental source

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/2956aca14dd2977cd08bd2ccafae3beb8b84b268

    Supplemental source

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/fbd977e513971ccb4f0762a7f59eac500e474f89

    Supplemental source

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/5213f65a9667d3dd85db2e6df8f2e0516290db34

    Supplemental source

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.