---
id: CVE-2026-43034
title: 'bnxt_en: set backing store type from query type'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  bnxt_en: set backing store type from query type

  bnxt_hwrm_func_backing_store_qcaps_v2() stores resp->type from the
  firmware response in ctxm->type and later uses that …
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 6a4d0774f02d61f8c75ffe2e38a8553410fe52e9 <
    c66a27ca534580de1d28cf568f59fe5f50d43e15
  - >-
    Linux >= 6a4d0774f02d61f8c75ffe2e38a8553410fe52e9 <
    c8d53b70166d1dc463ef42adb7293e1a770822c7
  - >-
    Linux >= 6a4d0774f02d61f8c75ffe2e38a8553410fe52e9 <
    29732b68a6816a815d58e9ab229844c23617e1e0
  - >-
    Linux >= 6a4d0774f02d61f8c75ffe2e38a8553410fe52e9 <
    4ee937107d52f9e5c350e4b5e629760e328b3d9f
  - Linux 6.8
published: '2026-05-01'
updated: '2026-10-21'
sourceUpdated: '2026-10-21T12:39:53.398Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-43034'
references:
  - url: 'https://git.kernel.org/stable/c/c66a27ca534580de1d28cf568f59fe5f50d43e15'
  - url: 'https://git.kernel.org/stable/c/c8d53b70166d1dc463ef42adb7293e1a770822c7'
  - url: 'https://git.kernel.org/stable/c/29732b68a6816a815d58e9ab229844c23617e1e0'
  - url: 'https://git.kernel.org/stable/c/4ee937107d52f9e5c350e4b5e629760e328b3d9f'
tags:
  - cve.org
epss: 0.0016
epssPercentile: 0.04779
ingestedAt: '2026-10-21T12:48:53.653Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

bnxt_en: set backing store type from query type

bnxt_hwrm_func_backing_store_qcaps_v2() stores resp->type from the
firmware response in ctxm->type and later uses that value to index
fixed backing-store metadata arrays such as ctx_arr[] and
bnxt_bstore_to_trace[].

ctxm->type is fixed by the current backing-store query type and matches
the array index of ctx->ctx_arr. Set ctxm->type from the current loop
variable instead of depending on resp->type.

Also update the loop to advance type from next_valid_type in the for
statement, which keeps the control flow simpler for non-valid and
unchanged entries.

## Affected

- `Linux >= 6a4d0774f02d61f8c75ffe2e38a8553410fe52e9 < c66a27ca534580de1d28cf568f59fe5f50d43e15`
- `Linux >= 6a4d0774f02d61f8c75ffe2e38a8553410fe52e9 < c8d53b70166d1dc463ef42adb7293e1a770822c7`
- `Linux >= 6a4d0774f02d61f8c75ffe2e38a8553410fe52e9 < 29732b68a6816a815d58e9ab229844c23617e1e0`
- `Linux >= 6a4d0774f02d61f8c75ffe2e38a8553410fe52e9 < 4ee937107d52f9e5c350e4b5e629760e328b3d9f`
- `Linux 6.8`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.