In the Linux kernel, the following vulnerability has been resolved:
eth: bnxt: fix truesize for mb-xdp-pass case
When mb-xdp is set and return is XDP_PASS, packet is converted from xdp_buff to sk_buff with xdp_update_skb_shared_info() in bnxt_xdp_build_skb(). bnxt_xdp_build_skb() passes incorrect truesize argument to xdp_update_skb_shared_info(). The truesize is calculated as BNXT_RX_PAGE_SIZE * sinfo->nr_frags but the skb_shared_info was wiped by napi_build_skb() before. So it stores sinfo->nr_frags before bnxt_xdp_build_skb() and use it instead of getting skb_shared_info from xdp_get_shared_info_from_buff().
Splat looks like: ------------[ cut here ]------------ WARNING: CPU: 2 PID: 0 at net/core/skbuff.c:6072 skb_try_coalesce+0x504/0x590 Modules linked in: xt_nat xt_tcpudp veth af_packet xt_conntrack nft_chain_nat xt_MASQUERADE nf_conntrack_netlink xfrm_user xt_addrtype nft_coms CPU: 2 UID: 0 PID: 0 Comm: swapper/2 Not tainted 6.14.0-rc2+ #3 RIP: 0010:skb_try_coalesce+0x504/0x590 Code: 4b fd ff ff 49 8b 34 24 40 80 e6 40 0f 84 3d fd ff ff 49 8b 74 24 48 40 f6 c6 01 0f 84 2e fd ff ff 48 8d 4e ff e9 25 fd ff ff <0f> 0b e99 RSP: 0018:ffffb62c4120caa8 EFLAGS: 00010287 RAX: 0000000000000003 RBX: ffffb62c4120cb14 RCX: 0000000000000ec0 RDX: 0000000000001000 RSI: ffffa06e5d7dc000 RDI: 0000000000000003 RBP: ffffa06e5d7ddec0 R08: ffffa06e6120a800 R09: ffffa06e7a119900 R10: 0000000000002310 R11: ffffa06e5d7dcec0 R12: ffffe4360575f740 R13: ffffe43600000000 R14: 0000000000000002 R15: 0000000000000002 FS: 0000000000000000(0000) GS:ffffa0755f700000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f147b76b0f8 CR3: 00000001615d4000 CR4: 00000000007506f0 PKRU: 55555554 Call Trace: <IRQ> ? __warn+0x84/0x130 ? skb_try_coalesce+0x504/0x590 ? report_bug+0x18a/0x1a0 ? handle_bug+0x53/0x90 ? exc_invalid_op+0x14/0x70 ? asm_exc_invalid_op+0x16/0x20 ? skb_try_coalesce+0x504/0x590 inet_frag_reasm_finish+0x11f/0x2e0 ip_defrag+0x37a/0x900 ip_local_deliver+0x51/0x120 ip_sublist_rcv_finish+0x64/0x70 ip_sublist_rcv+0x179/0x210 ip_list_rcv+0xf9/0x130
How to reproduce: <Node A> ip link set $interface1 xdp obj xdp_pass.o ip link set $interface1 mtu 9000 up ip a a 10.0.0.1/24 dev $interface1 <Node B> ip link set $interfac2 mtu 9000 up ip a a 10.0.0.2/24 dev $interface2 ping 10.0.0.1 -s 65000
Following ping.py patch adds xdp-mb-pass case. so ping.py is going to be able to reproduce this issue.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade kernel-tools-libs-develUpgrade kernel-tools-libsUpgrade kernel-rt-64kUpgrade kernel-rt-debugUpgrade kernel-rt-64k-debug-modules-coreUpgrade kernel-debug-develUpgrade kernel-abi-stablelistsUpgrade kernel-64k-debug-coreUpgrade kernel-debug-modulesUpgrade kernel-64kUpgrade kernel-rt-coreUpgrade kernel-rt-64k-develUpgrade kernel-rt-64k-modulesUpgrade kernel-rt-64k-debug-develUpgrade kernel-rt-modules-extraUpgrade python3-perfUpgrade kernel-rt-develUpgrade kernel-headersUpgrade kernel-rt-64k-modules-coreUpgrade kernel-64k-coreUpgrade kernel-rt-64k-coreUpgrade kernel-zfcpdump-modules-coreUpgrade kernel-rt-64k-debug-modules-extraUpgrade kernel-rt-64k-debug-coreUpgrade kernel-64k-modulesUpgrade kernel-rt-kvmUpgrade kernel-rt-64k-debug-modulesUpgrade kernel-debug-uki-virtUpgrade kernel-debug-devel-matchedUpgrade kernelUpgrade kernel-rt-64k-debugUpgrade kernel-cross-headersUpgrade kernel-64k-modules-coreUpgrade kernel-modules-coreUpgrade kernel-rt-debug-coreUpgrade rtlaUpgrade kernel-debug-modules-coreUpgrade kernel-64k-debug-modules-coreUpgrade kernel-modules-extraUpgrade kernel-zfcpdump-modules-extraUpgrade rvUpgrade kernel-debug-coreUpgrade kernel-coreUpgrade kernel-zfcpdump-devel-matchedUpgrade kernel-zfcpdump-coreUpgrade kernel-uki-virtUpgrade kernel-rt-64k-modules-extraUpgrade kernel-64k-modules-extraUpgrade kernel-64k-develUpgrade kernel-64k-debugUpgrade kernel-64k-devel-matchedUpgrade kernel-64k-debug-modules-extraUpgrade kernel-64k-debug-develUpgrade kernel-devel-matchedUpgrade kernel-rt-debug-develUpgrade kernel-toolsUpgrade kernel-docUpgrade kernel-modulesUpgrade kernel-64k-debug-devel-matchedUpgrade libperfUpgrade kernel-rt-modules-coreUpgrade kernel-zfcpdump-develUpgrade kernel-rt-modulesUpgrade kernel-rt-debug-modules-extraUpgrade kernel-rt-debug-modules-coreUpgrade kernel-debugUpgrade kernel-zfcpdumpUpgrade kernel-rt-debug-kvmUpgrade kernel-rt-debug-modulesUpgrade kernel-rtUpgrade kernel-64k-debug-modulesUpgrade kernel-develUpgrade kernel-debug-modules-extraUpgrade kernel-uki-virt-addonsUpgrade kernel-zfcpdump-modulesUpgrade perf | Jul 4, 2025 | Apr 1, 2025 |
| Debian | — | Upgrade linux | May 15, 2025 | Apr 1, 2025 |
| Oracle_linux | — | Upgrade kernel | Jun 30, 2025 | Apr 1, 2025 |
| Redhat_linux | — | No solution existsUpgrade kernelUpgrade kernel-rt | Jun 17, 2025 | Apr 1, 2025 |
| Rocky_linux | — | Upgrade kernel-zfcpdump-modules-extraUpgrade kernel-zfcpdumpUpgrade kernel-tools-debuginfoUpgrade kernel-cross-headersUpgrade kernel-modules-coreUpgrade kernel-rt-debugUpgrade kernel-rt-debug-kvmUpgrade kernel-rt-develUpgrade kernel-debugUpgrade python3-perfUpgrade kernel-debug-uki-virtUpgrade python3-perf-debuginfoUpgrade kernelUpgrade kernel-modulesUpgrade kernel-headersUpgrade kernel-debug-develUpgrade kernel-debug-modules-coreUpgrade kernel-rt-debug-modules-extraUpgrade kernel-zfcpdump-develUpgrade perfUpgrade rtlaUpgrade perf-debuginfoUpgrade kernel-uki-virtUpgrade kernel-debuginfoUpgrade kernel-modules-extraUpgrade kernel-rt-debug-develUpgrade kernel-rt-coreUpgrade kernel-rt-debug-modulesUpgrade kernel-debug-coreUpgrade kernel-coreUpgrade kernel-zfcpdump-debuginfoUpgrade libperfUpgrade kernel-tools-libsUpgrade kernel-develUpgrade kernel-toolsUpgrade kernel-rtUpgrade kernel-devel-matchedUpgrade kernel-zfcpdump-coreUpgrade kernel-tools-libs-develUpgrade rvUpgrade kernel-rt-modulesUpgrade libperf-debuginfoUpgrade kernel-rt-kvmUpgrade kernel-zfcpdump-devel-matchedUpgrade kernel-debug-modulesUpgrade kernel-uki-virt-addonsUpgrade kernel-rt-modules-extraUpgrade kernel-rt-debug-modules-coreUpgrade kernel-zfcpdump-modulesUpgrade kernel-debug-devel-matchedUpgrade kernel-rt-debuginfoUpgrade kernel-debug-debuginfoUpgrade kernel-rt-modules-coreUpgrade kernel-zfcpdump-modules-coreUpgrade kernel-rt-debug-debuginfoUpgrade kernel-rt-debug-coreUpgrade kernel-debug-modules-extra | Oct 6, 2025 | Oct 4, 2025 |
| Suse | — | Upgrade dtb-allwinnerUpgrade dtb-xilinxUpgrade kernel-kvmsmall-develUpgrade gfs2-kmp-rtUpgrade kernel-obs-qaUpgrade dlm-kmp-azureUpgrade dtb-nvidiaUpgrade kernel-default-base-rebuildUpgrade kernel-default-extraUpgrade dtb-armUpgrade dtb-renesasUpgrade gfs2-kmp-64kbUpgrade kernel-default-vdsoUpgrade kernel-64kb-develUpgrade gfs2-kmp-azureUpgrade dtb-hisiliconUpgrade kernel-defaultUpgrade kernel-64kb-optionalUpgrade dtb-qcomUpgrade dtb-mediatekUpgrade kernel-default-livepatch-develUpgrade kernel-docsUpgrade reiserfs-kmp-defaultUpgrade kernel-zfcpdumpUpgrade ocfs2-kmp-azureUpgrade kernel-rt-develUpgrade dtb-exynosUpgrade kernel-symsUpgrade ocfs2-kmp-defaultUpgrade dtb-rockchipUpgrade dtb-caviumUpgrade kernel-develUpgrade kernel-debug-develUpgrade kselftests-kmp-64kbUpgrade ocfs2-kmp-rtUpgrade kernel-debugUpgrade kernel-sourceUpgrade reiserfs-kmp-azureUpgrade dtb-apmUpgrade kernel-default-baseUpgrade kernel-default-optionalUpgrade kernel-devel-rtUpgrade kselftests-kmp-defaultUpgrade cluster-md-kmp-azureUpgrade cluster-md-kmp-rtUpgrade dtb-lgUpgrade dtb-marvellUpgrade kernel-azure-develUpgrade kernel-syms-rtUpgrade kernel-azureUpgrade kernel-azure-extraUpgrade kernel-source-vanillaUpgrade kernel-rt_debug-vdsoUpgrade kernel-obs-buildUpgrade dtb-appleUpgrade cluster-md-kmp-defaultUpgrade kselftests-kmp-azureUpgrade kselftests-kmp-rtUpgrade kernel-rt-extraUpgrade dlm-kmp-64kbUpgrade kernel-kvmsmallUpgrade kernel-docs-htmlUpgrade kernel-source-rtUpgrade kernel-debug-vdsoUpgrade ocfs2-kmp-64kbUpgrade kernel-azure-optionalUpgrade dtb-freescaleUpgrade dtb-amdUpgrade dtb-alteraUpgrade dlm-kmp-defaultUpgrade kernel-rt_debug-develUpgrade dtb-broadcomUpgrade kernel-source-azureUpgrade reiserfs-kmp-rtUpgrade kernel-kvmsmall-vdsoUpgrade kernel-default-livepatchUpgrade kernel-default-develUpgrade dtb-amlogicUpgrade dtb-amazonUpgrade dlm-kmp-rtUpgrade reiserfs-kmp-64kbUpgrade kernel-rtUpgrade kernel-64kb-extraUpgrade gfs2-kmp-defaultUpgrade kernel-rt_debugUpgrade kernel-rt-livepatch-develUpgrade kernel-macrosUpgrade cluster-md-kmp-64kbUpgrade kernel-syms-azureUpgrade kernel-rt-vdsoUpgrade kernel-rt-optionalUpgrade kernel-azure-vdsoUpgrade kernel-devel-azureUpgrade kernel-64kbUpgrade dtb-sprdUpgrade dtb-socionext | Dec 5, 2025 | Jun 19, 2025 |
| Ubuntu | — | Upgrade linux-image-6.11.0-1017-oracle-64kUpgrade linux-image-oracle-6.8Upgrade linux-image-virtual-6.8Upgrade linux-image-azureUpgrade linux-image-realtimeUpgrade linux-image-raspiUpgrade linux-image-aws-64k-6.8Upgrade linux-image-6.11.0-1016-gcp-64kUpgrade linux-image-6.11.0-28-genericUpgrade linux-image-6.8.0-1039-awsUpgrade linux-image-6.11.0-1018-azure-fdeUpgrade linux-image-oracle-64k-lts-24.04Upgrade linux-image-azure-nvidiaUpgrade linux-image-ibm-lts-24.04Upgrade linux-image-azure-fde-edgeUpgrade linux-image-oracleUpgrade linux-image-6.8.0-1039-nvidia-lowlatency-64kUpgrade linux-image-6.8.0-1039-aws-64kUpgrade linux-image-6.8.0-1039-nvidia-64kUpgrade linux-image-ibmUpgrade linux-image-lowlatency-6.11Upgrade linux-image-6.8.0-1036-gke-64kUpgrade linux-image-azure-fde-6.11Upgrade linux-image-generic-6.8Upgrade linux-image-nvidia-lowlatencyUpgrade linux-image-6.8.0-84-lowlatencyUpgrade linux-image-raspi-realtimeUpgrade linux-image-6.8.0-1037-oracleUpgrade linux-image-ibm-classicUpgrade linux-image-lowlatency-64k-hwe-24.04Upgrade linux-image-generic-64k-hwe-24.04Upgrade linux-image-awsUpgrade linux-image-gcp-6.8Upgrade linux-image-ibm-6.8Upgrade linux-image-nvidia-64kUpgrade linux-image-generic-hwe-22.04Upgrade linux-image-6.8.0-1023-gkeopUpgrade linux-image-6.8.0-85-generic-64kUpgrade linux-image-6.11.0-1016-gcpUpgrade linux-image-6.11.0-28-generic-64kUpgrade linux-image-generic-hwe-24.04Upgrade linux-image-nvidia-64k-6.8Upgrade linux-image-6.8.0-1037-ibmUpgrade linux-image-oracle-64kUpgrade linux-image-6.8.0-84-genericUpgrade linux-image-6.8.0-84-generic-64kUpgrade linux-image-6.11.0-1018-azureUpgrade linux-image-aws-64k-lts-24.04Upgrade linux-image-6.8.0-1040-gcpUpgrade linux-image-gkeop-6.8Upgrade linux-image-azure-lts-24.04Upgrade linux-image-gcp-lts-24.04Upgrade linux-image-gcpUpgrade linux-image-azure-6.11Upgrade linux-image-nvidia-lowlatency-64kUpgrade linux-image-gke-64kUpgrade linux-image-6.11.0-1015-lowlatency-64kUpgrade linux-image-gke-64k-6.8Upgrade linux-image-generic-64k-6.8Upgrade linux-image-aws-lts-24.04Upgrade linux-image-oem-22.04bUpgrade linux-image-kvmUpgrade linux-image-6.11.0-1015-lowlatencyUpgrade linux-image-6.8.0-1025-azure-nvidiaUpgrade linux-image-azure-fdeUpgrade linux-image-lowlatency-64k-6.11Upgrade linux-image-azure-fde-lts-24.04Upgrade linux-image-6.11.0-1011-realtimeUpgrade linux-image-oem-22.04dUpgrade linux-image-lowlatency-64kUpgrade linux-image-lowlatency-64k-hwe-22.04Upgrade linux-image-generic-64k-hwe-22.04Upgrade linux-image-genericUpgrade linux-image-6.11.0-1017-oracleUpgrade linux-image-generic-lpaeUpgrade linux-image-6.11.0-1024-oemUpgrade linux-image-generic-64kUpgrade linux-image-oem-22.04cUpgrade linux-image-lowlatency-64k-6.8Upgrade linux-image-6.8.0-2031-raspi-realtimeUpgrade linux-image-6.11.0-1015-awsUpgrade linux-image-azure-fde-6.8Upgrade linux-image-oracle-lts-24.04Upgrade linux-image-nvidiaUpgrade linux-image-aws-6.8Upgrade linux-image-6.8.0-1036-azure-fdeUpgrade linux-image-gcp-64k-6.8Upgrade linux-image-6.8.0-1038-azure-fdeUpgrade linux-image-6.8.0-1038-azureUpgrade linux-image-lowlatency-hwe-24.04Upgrade linux-image-gcp-64k-lts-24.04Upgrade linux-image-oem-22.04Upgrade linux-image-6.8.0-1039-raspiUpgrade linux-image-6.8.0-1039-nvidiaUpgrade linux-image-aws-64kUpgrade linux-image-nvidia-lowlatency-6.8Upgrade linux-image-gke-6.8Upgrade linux-image-6.8.0-1036-azureUpgrade linux-image-oracle-64k-6.8Upgrade linux-image-realtime-6.8.1Upgrade linux-image-nvidia-6.8Upgrade linux-image-raspi-6.8Upgrade linux-image-azure-6.8Upgrade linux-image-oem-24.04bUpgrade linux-image-6.8.0-1037-oracle-64kUpgrade linux-image-virtual-hwe-22.04Upgrade linux-image-6.8.0-84-lowlatency-64kUpgrade linux-image-lowlatencyUpgrade linux-image-6.8.0-1040-gcp-64kUpgrade linux-image-6.8.0-1039-nvidia-lowlatencyUpgrade linux-image-6.8.0-1036-gkeUpgrade linux-image-6.11.0-1014-raspiUpgrade linux-image-virtualUpgrade linux-image-lowlatency-6.8Upgrade linux-image-gkeopUpgrade linux-image-nvidia-hwe-22.04Upgrade linux-image-gkeUpgrade linux-image-gcp-64kUpgrade linux-image-6.8.1-1034-realtimeUpgrade linux-image-realtime-hwe-22.04Upgrade linux-image-oem-22.04aUpgrade linux-image-nvidia-64k-hwe-22.04Upgrade linux-image-raspi-realtime-6.8Upgrade linux-image-lowlatency-hwe-22.04Upgrade linux-image-nvidia-lowlatency-64k-6.8Upgrade linux-image-virtual-hwe-24.04Upgrade linux-image-azure-nvidia-lts-24.04Upgrade linux-image-6.8.0-85-genericUpgrade linux-image-azure-nvidia-6.8 | Jun 26, 2025 | Apr 1, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub