CVE-2026-74269

This is a regression vulnerability in the bnxt driver where a fix for large page support introduced a double-free that only manifests on driver teardown, making it exceptionally difficult to diagnose in production. The original large-page fix added a fixed rx_offset subtraction (258 bytes) to handle NET_IP_ALIGN + XDP_PACKET_HEADROOM, but this arithmetic fails when XDP head-adjustment operations shift data_ptr to within 2 bytes of the fragment start—creating a head-underflow that drops the page pool fragment reference on the wrong page. Normal packet processing continues unaffected because the corrupted reference count only matters when the prematurely recycled page is encountered again, which typically happens only at driver teardown. This latency is the critical diagnostic challenge: the developer who wrote the regression fix ran tests that passed because they validated the large-page scenario in isolation, not the interaction between XDP head-grow and the new offset subtraction. The fix—adding an offset field to bnxt_sw_rx_bd—is structurally correct, but the deeper concern is blast radius through the shared page pool infrastructure. When the corrupted page re-enters the free list, it can be handed out to any driver using that pool, creating a lateral corruption vector that affects the entire system rather than just bnxt. Between the incorrect free and driver teardown, there's a latent use-after-free window that standard page pool safeguards cannot detect because they trust the reference count. This isn't just a crash-on-shutdown bug—it silently corrupts memory state that can propagate across driver boundaries. The 258-byte constant itself is a frozen snapshot of architectural assumptions (NET_IP_ALIGN + XDP_PACKET_HEADROOM) that were never re-audited across all supported architectures and page sizes. The priority question is whether other bnxt receive paths have similar fixed-offset assumptions, and whether other kernel drivers with analogous rx_offset subtraction patterns should be audited for this same head-grow interaction. For defenders: prioritize this patch in containerized environments where driver teardown occurs during namespace cleanup, and monitor for unexplained reference count warnings in page pool allocations preceding any bnxt unload events.

Reviewed through automated stages and approved by a human before publication.