CVE-2026-23041: 
Linux Debian vulnerability analysis and mitigation

CVE-2026-23041 is a NULL pointer dereference vulnerability in the Linux kernel's bnxt_en (Broadcom NetXtreme) Ethernet driver, specifically in the bnxt_ptp_enable() function during error cleanup. The flaw is triggered when bnxt_init_one() fails during initialization: the error path destroys the DMA pool (setting bp->hwrm_dma_pool to NULL), and a subsequent call to ptp_clock_unregister() invokes the driver's .enable() callback, which attempts to allocate from the now-NULL pool. It affects the Linux kernel and was published on February 4, 2026. The CVSS category is estimated as Medium, with an EPSS score of 0.024% (Feedly, CVE.org).

The root cause is a NULL pointer dereference (CWE-476) in the bnxt_en driver's error cleanup path. When bnxt_init_one() fails (e.g., bnxt_init_int_mode returns -ENODEV), bnxt_free_hwrm_resources() is called, which destroys the DMA pool and sets bp->hwrm_dma_pool to NULL. Subsequently, bnxt_ptp_clear() calls ptp_clock_unregister(), which — since commit a60fc3294a37 ("ptp: rework ptp_clock_unregister() to disable events") — now invokes ptp_disable_all_events(), triggering the driver's .enable() callback (bnxt_ptp_enable()). This callback calls hwrm_req_init() via bnxt_ptp_cfg_pin() and bnxt_ptp_cfg_event(), which attempts to allocate from the NULL DMA pool, resulting in a KASAN-detected null-ptr-deref in the range [0x0000000000000028-0x000000000000002f] (Feedly). The vulnerability is local in nature and requires a specific hardware initialization failure condition to trigger.

Successful triggering of this vulnerability causes a kernel NULL pointer dereference, which typically results in a kernel panic (system crash), impacting availability. The crash occurs during device initialization failure cleanup, so it primarily affects systems with Broadcom NetXtreme (bnxt_en) network adapters where initialization fails. There is no evidence of confidentiality or integrity impact; the primary consequence is a denial of service via kernel crash (Feedly).

There is no known public exploit code or evidence of in-the-wild exploitation for CVE-2026-23041. The vulnerability requires local access and a specific hardware/driver initialization failure scenario, making opportunistic exploitation unlikely. The EPSS score is 0.024%, reflecting very low exploitation probability, and it is not listed in the CISA Known Exploited Vulnerabilities catalog (Feedly). Nessus plugin 297940 has been published to detect affected systems (Tenable).

Apply the upstream Linux kernel patches referenced in the CVE, available via the stable kernel git repository (commits 0174d5466cae and 3358995b1a7f). Users should update to a patched kernel version that includes the fix for the bnxt_ptp_enable() NULL pointer dereference. As a workaround, systems without Broadcom NetXtreme adapters are not affected; disabling or not loading the bnxt_en module on affected hardware may reduce exposure until a patch is applied (CVE.org, Kernel Git).