CVE-2026-53177

Description

In the Linux kernel, the following vulnerability has been resolved: bnxt_en: Fix NULL pointer dereference PCIe errors detected by a Root Port or Downstream Port cause error recovery services to run on all subordinate devices regardless of administrative state. The .error_detected() callback, bnxt_io_error_detected(), disables and synchronizes IRQs via bnxt_disable_int_sync(), which calls bnxt_cp_num_to_irq_num() to map completion rings to IRQs using bp->bnapi. Since bp->bnapi is allocated on NIC open and freed on NIC close, PCIe error recovery on a closed NIC can dereference a NULL pointer. Check if bp->bnapi is NULL before disabling and synchronizing IRQs.

EPSS — Exploit Prediction

0.0018

Probability of exploitation

0.07%

Percentile rank

EPSS estimates the probability that this vulnerability will be exploited in the wild within the next 30 days. A higher score means more likely to be exploited.

References

Other References

https://git.kernel.org/stable/c/08e57d014ea19f303d5d57a849beb846f37788b7 https://git.kernel.org/stable/c/1a418ad0e5e525d1d117dd1601681f75455af320 https://git.kernel.org/stable/c/3884976f87448e269908ae61bd5d62d54ce9c0c7 https://git.kernel.org/stable/c/580844a9683afe7974856dd5b7886447435b3474 https://git.kernel.org/stable/c/59c5a3e69c7630a811565937e64be70b08436761 https://git.kernel.org/stable/c/964b1c3eb71afe58bb61c8b984164447e000ae8a https://git.kernel.org/stable/c/d930276f2cddd0b7294cac7a8fe7b877f6d9e08d

Frequently Asked Questions

What is CVE-2026-53177? +

In the Linux kernel, the following vulnerability has been resolved: bnxt_en: Fix NULL pointer dereference PCIe errors detected by a Root Port or Downstream Port cause error recovery services to run on all subordinate devices regardless of administrative state. The .error_detected() callback, bnxt_io_error_detected(), disables and synchronizes IRQs via bnxt_disable_int_sync(), which calls bnxt_cp_num_to_irq_num() to map completion rings to IRQs using bp->bnapi. Since bp->bnapi is allocated on NIC open and freed on NIC close, PCIe error recovery on a closed NIC can dereference a NULL pointer. Check if bp->bnapi is NULL before disabling and synchronizing IRQs.

How do I check if I'm vulnerable to CVE-2026-53177? +

You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.

Description

EPSS — Exploit Prediction

References

Other References

Frequently Asked Questions

Don't wait for an exploit