---
cve: "CVE-2026-53177"
severity: "LOW"
cvss: 3.1
epss: "12%"
vendor: "Linux"
kev: false
exploited: false
published: "2026-06-25 09:16:35"
tags: [cve, security, low]
source: tsecurity.de CVE-Dossier
exported: "2026-09-07T00:37:39+02:00"
---

# CVE-2026-53177

> 3.1 LOW

## Beschreibung

In the Linux kernel, the following vulnerability has been resolved:

bnxt_en: Fix NULL pointer dereference

PCIe errors detected by a Root Port or Downstream Port cause error
recovery services to run on all subordinate devices regardless of
administrative state.

The .error_detected() callback, bnxt_io_error_detected(), disables
and synchronizes IRQs via bnxt_disable_int_sync(), which calls
bnxt_cp_num_to_irq_num() to map completion rings to IRQs using
bp->bnapi.

Since bp->bnapi is allocated on NIC open and freed on NIC close, PCIe
error recovery on a closed NIC can dereference a NULL pointer.

Check if bp->bnapi is NULL before disabling and synchronizing IRQs.

## Patch verfügbar (OSV)

- Kernel ≥ 5.10.260
- Kernel ≥ 5.15.210
- Kernel ≥ 6.1.176
- Kernel ≥ 6.6.143
- Kernel ≥ 6.12.94
- Kernel ≥ 6.18.36
- Kernel ≥ 7.0.13

## Referenzen

- <https://git.kernel.org/stable/c/1449177b87f768353909e930a99b902675119b2b>
- <https://git.kernel.org/stable/c/964b1c3eb71afe58bb61c8b984164447e000ae8a>
- <https://git.kernel.org/stable/c/59c5a3e69c7630a811565937e64be70b08436761>
- <https://git.kernel.org/stable/c/1a418ad0e5e525d1d117dd1601681f75455af320>
- <https://git.kernel.org/stable/c/08e57d014ea19f303d5d57a849beb846f37788b7>
- <https://git.kernel.org/stable/c/3884976f87448e269908ae61bd5d62d54ce9c0c7>
- <https://git.kernel.org/stable/c/580844a9683afe7974856dd5b7886447435b3474>
- <https://git.kernel.org/stable/c/d930276f2cddd0b7294cac7a8fe7b877f6d9e08d>

---
_Exportiert aus dem [tsecurity.de CVE-Dossier](https://tsecurity.de/cve?cve=CVE-2026-53177) · Datenquellen: EUVD (ENISA), NVD, OSV, CISA KEV, FIRST EPSS, Exploit-DB, BSI BITS_