Linux kernel bnxt_en driver vulnerabilities

A vulnerability related to the RSS context deletion logic in the bnxt_en driver has been fixed in the Linux kernel. The issue was that an incorrect check of the network interface state led to VNIC leaks in firmware, potentially resulting in the loss of active RSS contexts.

In the Linux kernel, the bnxt_en driver has a DMA mapping length bug for padded small packets. bnxt_start_xmit() pads packets smaller than 52 bytes, but the length passed to dma_map_single() is not adjusted, so the NIC DMA engine reads beyond the mapped region, causing IOMMU faults and transmit queue timeouts.

In the Linux kernel, the bnxt_en driver has an out-of-bounds write in bnxt_alloc_agg_idx. When firmware advertises fewer concurrent TPAs (e.g., 32) than the maximum, the TPA ID can exceed the size of the rx_tpa array, leading to invalid memory access and a kernel crash at boot.

In the Linux kernel, the bnxt_en driver has a bug that can cause the transmit queue to stop. When the driver defers completions for a burst of packets and then a large USO packet cannot fit in a small ring, the ring may become full of packets with suppressed completions, permanently stalling the queue. This affects small rings (up to 457 descriptors) and was fixed by clearing the NO_CMPL bit in bnxt_txr_db_kick().