CVE-2026-99081: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-99081 is a DMA mapping length miscalculation vulnerability in the Linux kernel's bnxt_en network driver (Broadcom NetXtreme-E NICs) that can cause a local denial of service. The flaw affects Linux kernel versions starting from 4.4 (introduced with commit c0c050c58d840994ba842ad1c338a98e7c12b764) and was disclosed on October 23, 2026. Fixed versions include 6.6.160, 6.12.113, 6.18.57, 7.2.11, and 7.3+. The CVSS category is estimated as Medium (GitHub Advisory, Feedly).

The root cause is an incorrect DMA buffer length calculation in bnxt_start_xmit() within the bnxt_en driver. When a packet smaller than BNXT_MIN_PKT_SIZE (52 bytes) — such as a 42-byte untagged ARP frame — is transmitted on a VLAN or macvlan interface, the code pads the packet via skb_pad() and updates length to 52, but leaves the len variable (initialized to skb_headlen(skb), e.g., 42 bytes) unchanged. As a result, dma_map_single() maps only 42 bytes, while the TX buffer descriptor instructs the NIC DMA engine to read 52 bytes. If skb->data ends within 10 bytes of a 4KB page boundary, the hardware DMA read overruns into the adjacent unmapped page, triggering an IOMMU fault. This issue was exposed after commit 447cbe95ebb9 ("vlan: fix skb_under_panic and races when toggling HW VLAN offload"), which shifted skb->data offsets by increasing LL_RESERVED_SPACE from 48 to 64 bytes. No CWE has been formally assigned, but the flaw is consistent with improper buffer size calculation (CWE-131) (GitHub Advisory).

Successful triggering of this vulnerability causes Intel IOMMU DMA Read faults, NIC firmware errors, transmit queue timeouts (NETDEV WATCHDOG), and ultimately a network interface hang on systems using BCM57412 or similar NetXtreme-E NICs. The impact is limited to availability — specifically, disruption of network services on the affected interface — with no evidence of confidentiality or integrity compromise. The vulnerability requires local access to transmit small packets on a VLAN or macvlan interface, limiting its scope to local denial of service (GitHub Advisory, Feedly).

There is no known public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the disclosure date. The vulnerability requires local access to a system with an affected Broadcom NetXtreme-E NIC configured with VLAN or macvlan interfaces. It is not listed in the CISA Known Exploited Vulnerabilities catalog, and no EPSS score or threat actor attribution is available (GitHub Advisory, Feedly).

• Logs: Kernel messages containing DMAR: [DMA Read NO_PASID] Request device [...] fault addr at a 4KB-aligned address (e.g., 0xfc499000); bnxt_en messages such as Abandoning msg ... due to firmware status: 0x2000001; NETDEV WATCHDOG: <iface> (bnxt_en): transmit queue 0 timed out.
• Network: Repeated transmit queue stalls or NIC resets on interfaces using VLAN or macvlan configurations with Broadcom NetXtreme-E (BCM574xx) adapters.
• System: Kernel IOMMU fault counters incrementing (/proc/interrupts or DMAR error counters); unexpected NIC firmware error logs in dmesg.

Apply the upstream kernel patches fixing the DMA mapping length: stable commits cf8530a25ae9 (6.6.x), 2956aca14dd2 (6.12.x), fbd977e51397 (6.18.x), 5213f65a9667 (7.2.x), and a51d233ccd48 (7.3+). The fix replaces the manual skb_pad() + length adjustment with skb_put_padto(skb, BNXT_MIN_PKT_SIZE), ensuring skb->len and skb_headlen() reflect the padded size before DMA mapping. As a temporary workaround, avoid transmitting small packets (< 52 bytes) on VLAN or macvlan interfaces, or disable affected interfaces until a patched kernel is available from your distribution (GitHub Advisory).

The vulnerability was reported by Stefan Fleischmann based on observed Intel IOMMU DMA Read faults on production systems, and the fix was submitted to the Linux stable kernel trees. Discussion was noted on the Linux CVE announce mailing list and tracked by VulDB and infosec.exchange (Feedly).