View Issue Details
| ID | Project | Category | View Status | Date Submitted | Last Update |
|---|---|---|---|---|---|
| 0000681 | AlmaLinux-10 | General | public | 2026-10-13 18:23 | 2026-10-19 00:09 |
| Reporter | martinminkus | Assigned To | alukoshko | ||
| Priority | urgent | Severity | major | Reproducibility | always |
| Status | feedback | Resolution | open | ||
| Summary | 0000681: kernel-6.12.0-211.64.1.el10_2: bnxt_en IOMMU faults and TX timeouts with VLANs (exposed by patch 1389); please carry upstream bn | ||||
| Description | Since kernel-6.12.0-211.64.1.el10_2, servers with Broadcom BCM57414 (bnxt_en) NICs carrying traffic on a VLAN lose networking within 1-2 minutes of boot. kernel-6.12.0-211.55.1.el10_2 is fine. Symptom (AMD EPYC, AMD-Vi enabled, 802.3ad bond with bond0.200 on top): bnxt_en 0000:41:00.1: AMD-Vi: Event logged [IO_PAGE_FAULT domain=0x0032 address=0xf25dd000 flags=0x0000] bnxt_en 0000:41:00.1 enp65s0f1np1: NETDEV WATCHDOG: CPU: 14: transmit queue 3 timed out 5986 ms bnxt_en 0000:41:00.1 enp65s0f1np1: TX timeout detected, starting reset task! bnxt_en 0000:41:00.1 enp65s0f1np1: hwrm_ring_free type 1 failed. rc:fffffff0 err:0 Root cause: a long-standing bnxt_en bug. bnxt_start_xmit() pads frames shorter than 52 bytes but DMA-maps only the unpadded length, so the NIC reads past the mapped buffer. Patch 1389 (upstream 447cbe95ebb9, "vlan: fix skb_under_panic and races when toggling HW VLAN offload", RHEL-254268, CVE-2026-80925) increases VLAN headroom, which makes those small frames end on page boundaries, so the overrun hits unmapped pages. Upstream fix: bnxt_en: fix DMA mapping length for padded small packets Eric Dumazet, 2026-10-07, Cc: stable https://lore.kernel.org/netdev/20261007051747.455273-1-edumazet@kernel.org/ Backport that applies cleanly to the 211.64.1 bnxt source (offset only; it is the Proxmox 6.12-era backport): https://git.proxmox.com/?p=pve-kernel.git;a=blob_plain;f=patches/kernel/0210-bnxt_en-fix-DMA-mapping-length-for-padded-small-pack.patch;hb=refs/heads/master Tested on the affected host, booting 211.64.1: - stock: IOMMU faults and TX timeouts within 1-2 minutes - 8021q rebuilt without patch 1389: clean (confirms the exposure path; we are not asking for 1389 to be dropped, it is a CVE fix) - bnxt_en rebuilt from the 211.64.1 source (including patch 1128) plus the fix above: clean for 60+ minutes (ongoing) under production load - bnxt_en without patch 1128 (TPH gate) still fails, so 1128 is not involved The RHEL 211.64.1 changelog carries RHEL-254268 without a bnxt_en fix, so this is inherited from RHEL, but since AlmaLinux already carries extra patches in the kernel (e.g. Patch2011-2016 in 211.55.1), we'd ask that this fix be added to the next AlmaLinux 10.2 kernel rather than waiting for RHEL. We have also filed it in RHEL Jira: RHEL-282334. Same bug reported on Proxmox (pve-kernel 7.0.14-20, BCM57412/57414, bond + VLAN), fixed there in 7.0.14-22/-23: https://forum.proxmox.com/threads/proxmox-ve-9-2-21-bcm57412-bnxt_en-network-failure-after-upgrade-to-kernel-7-0-14-20-pve.186749/ Full kernel logs available on request. | ||||
| Steps To Reproduce | Boot 6.12.0-211.64.1.el10_2.x86_64 with a Broadcom BCM57414 (bnxt_en) NIC. | ||||
| Tags | No tags attached. | ||||
|
|
Backport is ready and should be included into next AlmaLinux 10 kernel update https://git.almalinux.org/autopatch/kernel/commit/6f08999298f475ec4253d4db0725388b02fd410a |
|
|
kernel-6.12.0-211.66.1.el10_2 released with patch included. please check it. |
| Date Modified | Username | Field | Change |
|---|---|---|---|
| 2026-10-13 18:23 | martinminkus | New Issue | |
| 2026-10-14 13:07 | alukoshko | Assigned To | => alukoshko |
| 2026-10-14 13:07 | alukoshko | Status | new => assigned |
| 2026-10-14 13:08 | alukoshko | Note Added: 0001250 | |
| 2026-10-19 00:09 | alukoshko | Note Added: 0001251 | |
| 2026-10-19 00:09 | alukoshko | Status | assigned => feedback |
