CVE-2026-99081

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the bnxt start xmit() function where packets smaller than 52 bytes are padded to meet the minimum packet size. However, the DMA mapping length is not updated after padding, causing dma map single() and dma unmap len set() to track only the original length. When the NIC DMA engine attempts to read the full padded length, it may overrun into an unmapped adjacent page if the data ends near a 4KB page boundary, triggering an IOMMU (Input-Output Memory Management Unit) fault. An IOMMU is a system component that maps device-visible virtual addresses to physical addresses.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.