CVE-2026-97572

In the Linux kernel, the following vulnerability has been resolved:

bnxt_en: Propagate RX ring init failures in bnxt_init_nic()

bnxt_init_rx_rings() returns an error when bnxt_alloc_one_rx_ring()

fails, but bnxt_init_nic() discards that return value and calls

bnxt_init_chip(), which enables TPA.

If an allocation fails, this could leave rxr->rx_tpa[] partially zeroed

and TPA would be enabled over an array with zeroed entries. This would

lead to a zeroed DMA address being handed out if the agg_idx is

translated to a SW index at a zeroed entry.

Fix this by propagating the error out of bnxt_init_nic(). Both callers

already check its return value and unwind with bnxt_free_skbs() and

bnxt_free_mem(), which tolerate a partially initialized RX ring.