CVE-2026-43260

bnxt_en: Fix RSS context delete logic

7.8 HighFix available

In the Linux kernel, the following vulnerability has been resolved:

bnxt_en: Fix RSS context delete logic

We need to free the corresponding RSS context VNIC in FW everytime an RSS context is deleted in driver. Commit 667ac333dbb7 added a check to delete the VNIC in FW only when netif_running() is true to help delete RSS contexts with interface down.

Having that condition will make the driver leak VNICs in FW whenever close() happens with active RSS contexts. On the subsequent open(), as part of RSS context restoration, we will end up trying to create extra VNICs for which we did not make any reservation. FW can fail this request, thereby making us lose active RSS contexts.

Suppose an RSS context is deleted already and we try to process a delete request again, then the HWRM functions will check for validity of the request and they simply return if the resource is already freed. So, even for delete-when-down cases, netif_running() check is not necessary.

Remove the netif_running() condition check when deleting an RSS context.

Attack profile

How easy it is to exploit

Attack vector: Local
Complexity: Low
Privileges needed: Low
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: High

Exploit likelihood

0.14%Up 0.1 points since May 7, 2026

What each source reports

NVD Score used 7.8

In the Linux kernel, the following vulnerability has been resolved:

bnxt_en: Fix RSS context delete logic

Remove the netif_running() condition check when deleting an RSS context.

Record: CVE-2026-43260
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-415
Updated: 2026-11-06

CVE List No score

bnxt_en: Fix RSS context delete logic

In the Linux kernel, the following vulnerability has been resolved:

bnxt_en: Fix RSS context delete logic

Remove the netif_running() condition check when deleting an RSS context.

Record: CVE-2026-43260
Updated: 2026-11-06

EUVDEUVD-2026-27820 No score

In the Linux kernel, the following vulnerability has been resolved:

bnxt_en: Fix RSS context delete logic

Remove the netif_running() condition check when deleting an RSS context.

Record: EUVD-2026-27820
Updated: 2026-11-06

GitHub AdvisoriesGHSA-w6jm-j85g-vpgj 7.8

In the Linux kernel, the following vulnerability has been resolved: bnxt_en: Fix RSS context...

In the Linux kernel, the following vulnerability has been resolved:

bnxt_en: Fix RSS context delete logic

Remove the netif_running() condition check when deleting an RSS context.

Record: GHSA-w6jm-j85g-vpgj
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-415
Updated: 2026-11-02

OSVBELL-CVE-2026-43260 7.8

Record: BELL-CVE-2026-43260
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVDEBIAN-CVE-2026-43260 7.8

In the Linux kernel, the following vulnerability has been resolved: bnxt_en: Fix RSS context delete logic We need to free the corresponding RSS context VNIC in FW everytime an RSS context is deleted in driver. Commit 667ac333dbb7 added a check to delete the VNIC in FW only when netif_running() is true to help delete RSS contexts with interface down. Having that condition will make the driver leak VNICs in FW whenever close() happens with active RSS contexts. On the subsequent open(), as part of RSS context restoration, we will end up trying to create extra VNICs for which we did not make any reservation. FW can fail this request, thereby making us lose active RSS contexts. Suppose an RSS context is deleted already and we try to process a delete request again, then the HWRM functions will check for validity of the request and they simply return if the resource is already freed. So, even for delete-when-down cases, netif_running() check is not necessary. Remove the netif_running() condition check when deleting an RSS context.

Record: DEBIAN-CVE-2026-43260
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-07

Show 16 moreShow less

OSVRHSA-2026:27288 7.8

Red Hat Security Advisory: kernel security, bug fix, and enhancement update

Record: RHSA-2026:27288
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVRHSA-2026:27789 7.8

Red Hat Security Advisory: kernel security, bug fix, and enhancement update

Record: RHSA-2026:27789
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVRLSA-2026:27288 7.8

Important: kernel security, bug fix, and enhancement update

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

kernel: can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CVE-2026-31474)
kernel: mptcp: fix slab-use-after-free in __inet_lookup_established (CVE-2026-31669)
kernel: rxrpc: Fix RxGK token loading to check bounds (CVE-2026-31641)
kernel: xen/privcmd: fix double free via VMA splitting (CVE-2026-31787)
kernel: Buffer overflow in drivers/xen/sys-hypervisor.c (CVE-2026-31786)
kernel: net: mana: fix use-after-free in add_adev() error path (CVE-2026-43056)
kernel: Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CVE-2026-31772)
kernel: bnxt_en: Fix RSS context delete logic (CVE-2026-43260)
kernel: crypto: caam - fix overflow on long hmac keys (CVE-2026-43330)
kernel: net/sched: act_pedit: extend the writable skb range per key (CVE-2026-46331)
kernel: Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CVE-2026-46056)
kernel: wifi: mac80211: drop stray 'static' from fast-RX rx_result (CVE-2026-46152)
kernel: wifi: mac80211: remove station if connection prep fails (CVE-2026-46125)
kernel: exit: prevent preemption of oopsing TASK_DEAD task (CVE-2026-46173)
kernel: wifi: mac80211: use safe list iteration in radar detect work (CVE-2026-46166)

Bug Fix(es) and Enhancement(s):

Rocky Linux10.0 - s390/ap: Expose ap_bindings_complete_count counter via sysfs [rhel-10.2.z] (JIRA:Rocky Linux-166047)
Rocky Linux9.5 crash due to lpfc NULL ndlp->vport [rhel-10.2.z] (JIRA:Rocky Linux-171774)
objtool static_call check blocks build of out-of-tree livepatch modules on Rocky Linux 10.2 GA kernels ? missing upstream revert f495054bd12e (JIRA:Rocky Linux-178495)
ibmveth Adapter Freeze with Small MSS [rhel-10.2.z] (JIRA:Rocky Linux-179723)
rbd: eliminate a race in lock_dwork draining on unmap [rhel-10.2.z] (JIRA:Rocky Linux-183127)
Rocky Linux10.0 - s390/mm: Add missing secure storage access fixups [rhel-10.2.z] (JIRA:Rocky Linux-183319)
[Rocky Linux10.2.z] Enable Pretimeout Watchdog Panic Functionality on x86 (JIRA:Rocky Linux-182299)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record: RLSA-2026:27288
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVRLSA-2026:27789 7.8

Important: kernel security, bug fix, and enhancement update

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

kernel: can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CVE-2026-31474)
kernel: mptcp: fix slab-use-after-free in __inet_lookup_established (CVE-2026-31669)
kernel: xen/privcmd: fix double free via VMA splitting (CVE-2026-31787)
kernel: Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CVE-2026-31772)
kernel: bnxt_en: Fix RSS context delete logic (CVE-2026-43260)
kernel: ALSA: usb-audio: Add sanity check for OOB writes at silencing (CVE-2026-43279)
kernel: scsi: qla2xxx: Completely fix fcport double free (CVE-2026-43414)
kernel: net/sched: act_pedit: extend the writable skb range per key (CVE-2026-46331)
kernel: gfs2: Fix use-after-free in iomap inline data write path (CVE-2026-45984)
kernel: Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CVE-2026-46056)
kernel: wifi: mac80211: drop stray 'static' from fast-RX rx_result (CVE-2026-46152)
kernel: RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CVE-2026-46117)
kernel: RDMA/mana: Validate rx_hash_key_len (CVE-2026-46145)
kernel: wifi: mac80211: remove station if connection prep fails (CVE-2026-46125)
kernel: exit: prevent preemption of oopsing TASK_DEAD task (CVE-2026-46173)
kernel: wifi: mac80211: use safe list iteration in radar detect work (CVE-2026-46166)
kernel: nvmet-tcp: fix race between ICReq handling and queue teardown (CVE-2026-46135)

Bug Fix(es) and Enhancement(s):

Rocky Linux9.4 - s390/ap: Expose ap_bindings_complete_count counter via sysfs [rhel-9.8.z] (JIRA:Rocky Linux-166048)
[Rocky Linux 9.8] Hung tasks during both suspend and hibernate operations on systems with Intel E810 NICs [rhel-9.8.z] (JIRA:Rocky Linux-175699)
DPLL: Add support for pin operational state [rhel-9.8.z] (JIRA:Rocky Linux-175820)
DPLL: Add support for fractional frequency offset between pin and device [rhel-9.8.z] (JIRA:Rocky Linux-175823)
ibmveth Adapter Freeze with Small MSS [rhel-9.8.z] (JIRA:Rocky Linux-178308)
Rocky Linux9.4 - s390/mm: Add missing secure storage access fixups [rhel-9.8.z] (JIRA:Rocky Linux-183317)
rbd: eliminate a race in lock_dwork draining on unmap [rhel-9.8.z] (JIRA:Rocky Linux-183130)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record: RLSA-2026:27789
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVUBUNTU-CVE-2026-43260 7.8

Record: UBUNTU-CVE-2026-43260
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-11

OSVALSA-2026:27288 No score

Important: kernel security, bug fix, and enhancement update

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

kernel: can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CVE-2026-31474)
kernel: mptcp: fix slab-use-after-free in __inet_lookup_established (CVE-2026-31669)
kernel: rxrpc: Fix RxGK token loading to check bounds (CVE-2026-31641)
kernel: xen/privcmd: fix double free via VMA splitting (CVE-2026-31787)
kernel: Buffer overflow in drivers/xen/sys-hypervisor.c (CVE-2026-31786)
kernel: net: mana: fix use-after-free in add_adev() error path (CVE-2026-43056)
kernel: Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CVE-2026-31772)
kernel: bnxt_en: Fix RSS context delete logic (CVE-2026-43260)
kernel: crypto: caam - fix overflow on long hmac keys (CVE-2026-43330)
kernel: net/sched: act_pedit: extend the writable skb range per key (CVE-2026-46331)
kernel: Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CVE-2026-46056)
kernel: wifi: mac80211: drop stray 'static' from fast-RX rx_result (CVE-2026-46152)
kernel: wifi: mac80211: remove station if connection prep fails (CVE-2026-46125)
kernel: exit: prevent preemption of oopsing TASK_DEAD task (CVE-2026-46173)
kernel: wifi: mac80211: use safe list iteration in radar detect work (CVE-2026-46166)

Bug Fix(es) and Enhancement(s):

AlmaLinux10.0 - s390/ap: Expose ap_bindings_complete_count counter via sysfs [almalinux-10.2.z] (JIRA:AlmaLinux-166047)
AlmaLinux9.5 crash due to lpfc NULL ndlp->vport [almalinux-10.2.z] (JIRA:AlmaLinux-171774)
objtool static_call check blocks build of out-of-tree livepatch modules on AlmaLinux 10.2 GA kernels ? missing upstream revert f495054bd12e (JIRA:AlmaLinux-178495)
ibmveth Adapter Freeze with Small MSS [almalinux-10.2.z] (JIRA:AlmaLinux-179723)
rbd: eliminate a race in lock_dwork draining on unmap [almalinux-10.2.z] (JIRA:AlmaLinux-183127)
AlmaLinux10.0 - s390/mm: Add missing secure storage access fixups [almalinux-10.2.z] (JIRA:AlmaLinux-183319)
[AlmaLinux10.2.z] Enable Pretimeout Watchdog Panic Functionality on x86 (JIRA:AlmaLinux-182299)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record: ALSA-2026:27288
Updated: 2026-11-02

OSVALSA-2026:27789 No score

Important: kernel security, bug fix, and enhancement update

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

kernel: can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CVE-2026-31474)
kernel: mptcp: fix slab-use-after-free in __inet_lookup_established (CVE-2026-31669)
kernel: xen/privcmd: fix double free via VMA splitting (CVE-2026-31787)
kernel: Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CVE-2026-31772)
kernel: bnxt_en: Fix RSS context delete logic (CVE-2026-43260)
kernel: ALSA: usb-audio: Add sanity check for OOB writes at silencing (CVE-2026-43279)
kernel: scsi: qla2xxx: Completely fix fcport double free (CVE-2026-43414)
kernel: net/sched: act_pedit: extend the writable skb range per key (CVE-2026-46331)
kernel: gfs2: Fix use-after-free in iomap inline data write path (CVE-2026-45984)
kernel: Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CVE-2026-46056)
kernel: wifi: mac80211: drop stray 'static' from fast-RX rx_result (CVE-2026-46152)
kernel: RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CVE-2026-46117)
kernel: RDMA/mana: Validate rx_hash_key_len (CVE-2026-46145)
kernel: wifi: mac80211: remove station if connection prep fails (CVE-2026-46125)
kernel: exit: prevent preemption of oopsing TASK_DEAD task (CVE-2026-46173)
kernel: wifi: mac80211: use safe list iteration in radar detect work (CVE-2026-46166)
kernel: nvmet-tcp: fix race between ICReq handling and queue teardown (CVE-2026-46135)

Bug Fix(es) and Enhancement(s):

AlmaLinux9.4 - s390/ap: Expose ap_bindings_complete_count counter via sysfs [almalinux-9.8.z] (JIRA:AlmaLinux-166048)
[AlmaLinux 9.8] Hung tasks during both suspend and hibernate operations on systems with Intel E810 NICs [almalinux-9.8.z] (JIRA:AlmaLinux-175699)
DPLL: Add support for pin operational state [almalinux-9.8.z] (JIRA:AlmaLinux-175820)
DPLL: Add support for fractional frequency offset between pin and device [almalinux-9.8.z] (JIRA:AlmaLinux-175823)
ibmveth Adapter Freeze with Small MSS [almalinux-9.8.z] (JIRA:AlmaLinux-178308)
AlmaLinux9.4 - s390/mm: Add missing secure storage access fixups [almalinux-9.8.z] (JIRA:AlmaLinux-183317)
rbd: eliminate a race in lock_dwork draining on unmap [almalinux-9.8.z] (JIRA:AlmaLinux-183130)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record: ALSA-2026:27789
Updated: 2026-11-02

OSVCLSA-2026-1786352940 No score

kernel: Fix of 148 CVEs

KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level {CVE-2026-63807}
KVM: x86: Check for invalid/obsolete root after making MMU pages available {CVE-2026-64561}
ubi: Fix use-after-free when volume resizing failed {CVE-2023-53271}
ice: Check VF VSI Pointer Value in ice_vc_add_fdir_fltr() {CVE-2025-37912}
wifi: mt76: mt7925: prevent NULL pointer dereference in mt7925_tx_check_aggr() {CVE-2026-53318}
dpll: Prevent duplicate registrations {CVE-2026-23129}
pinmux: fix race causing mux_owner NULL with active mux_usecount {CVE-2025-38632}
HID: apple: validate feature-report field count to prevent NULL pointer dereference {CVE-2025-38557}
thunderbolt: Limit XDomain response copy to actual frame size {CVE-2026-53146}
net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery {CVE-2026-43466}
virtio_net: Fix UAF on dst_ops when IFF_XMIT_DST_RELEASE is cleared and napi_tx is false {CVE-2026-31469}
scsi: target: Reset t_task_cdb pointer in error case {CVE-2025-68782}
ubi: ubi_create_volume: Fix use-after-free when volume creation failed {CVE-2022-49388}
drm/xe/reg_sr: Fix leak on xa_store failure {CVE-2026-23418}
ASoC: soc-core: flush delayed work before removing DAIs and widgets {CVE-2026-43459}
md/raid10: wait barrier before returning discard request with REQ_NOWAIT {CVE-2025-40325}
nbd: defer config put in recv_work {CVE-2025-68372}
nvmet: fix race in nvmet_bio_done() leading to NULL pointer dereference {CVE-2026-23148}
net: hns3: using the num_tqps in the vf driver to apply for resources {CVE-2025-71064}
net/mlx5e: Disable MACsec offload for uplink representor profile {CVE-2025-38020}
serial: imx: fix tx statemachine deadlock {CVE-2023-52456}
dm-thin: fix metadata refcount underflow {CVE-2026-46107}
net/mlx5e: xsk: Fix DMA and xdp_frame leak on XDP_TX xmit failure {CVE-2026-53229}
drm/amdgpu: Fix use-after-free race in VM acquire {CVE-2026-43370}
usbnet:fix NPE during rx_complete {CVE-2025-22050}
platform/x86/amd/pmc: Only disable IRQ1 wakeup where i8042 actually enabled it {CVE-2025-21645}
driver core: class: Fix wild pointer dereferences in API class_dev_iter_next() {CVE-2025-21810}
usb: atm: cxacru: fix a flaw in existing endpoint checks {CVE-2025-21916}
ALSA: seq: dummy: fix UMP event stack overread {CVE-2026-53241}
pmdomain: imx8mp-blk-ctrl: Keep the NOC_HDCP clock enabled {CVE-2026-31655}
net/mlx5: Bridge, fix the crash caused by LAG state check {CVE-2025-21970}
ALSA: timer: Don't take register_mutex with copy_from/to_user() {CVE-2025-23134}
md/raid5: validate payload size before accessing journal metadata {CVE-2026-46070}
nvmet-fc: move lsop put work to nvmet_fc_ls_req_op {CVE-2025-40171}
iommu: Fix potential memory leak in iopf_queue_remove_device() {CVE-2025-21770}
Input: uinput - zero-initialize uinput_ff_upload_compat to avoid info leak {CVE-2025-40035}
scsi: sd: fix missing put_disk() when device_add(&disk_dev) fails {CVE-2026-45997}
can: dev: can_set_termination(): allow sleeping GPIOs {CVE-2024-56625}
nvme-tcp: fix the memleak while create new ctrl failed {CVE-2024-56632}
ALSA: usb-audio: Avoid potential endless loop in convert_chmap_v3() {CVE-2026-46146}
pmdomain: imx8m-blk-ctrl: fix out-of-range access of bc->domains {CVE-2026-23187}
wifi: ath12k: Clear affinity hint before calling ath12k_pci_free_irq() in error path {CVE-2025-22128}
octeon_ep: Fix memory leak in octep_device_setup() {CVE-2026-23160}
pinctrl: check the return value of pinmux_ops::get_function_name() {CVE-2025-40030}
net: tun: fix tun_napi_alloc_frags() {CVE-2024-56372}
wifi: iwlwifi: mvm: clean up ROC on failure {CVE-2025-21906}
ALSA: usb-audio: Fix NULL pointer dereference in snd_usb_mixer_controls_badd {CVE-2025-40275}
dpll: fix xa_alloc_cyclic() error handling {CVE-2025-22016}
usb: usbtmc: Flush anchored URBs in usbtmc_release {CVE-2026-31758}
RDMA/siw: Fix potential NULL pointer dereference in header processing…

Record: CLSA-2026-1786352940
Updated: 2026-11-02

OSV No score

bnxt_en: Fix RSS context delete logic

In the Linux kernel, the following vulnerability has been resolved:

bnxt_en: Fix RSS context delete logic

Remove the netif_running() condition check when deleting an RSS context.

Record: CVE-2026-43260
Updated: 2026-11-07

OSVopenSUSE-SU-2026:21388-1 No score