In the Linux kernel, the following vulnerability has been resolved:
bnxt_en: Fix receive ring space parameters when XDP is active
The MTU setting at the time an XDP multi-buffer is attached determines whether the aggregation ring will be used and the rx_skb_func handler. This is done in bnxt_set_rx_skb_mode().
If the MTU is later changed, the aggregation ring setting may need to be changed and it may become out-of-sync with the settings initially done in bnxt_set_rx_skb_mode(). This may result in random memory corruption and crashes as the HW may DMA data larger than the allocated buffer size, such as:
BUG: kernel NULL pointer dereference, address: 00000000000003c0 PGD 0 P4D 0 Oops: 0000 [#1] PREEMPT SMP NOPTI CPU: 17 PID: 0 Comm: swapper/17 Kdump: loaded Tainted: G S OE 6.1.0-226bf9805506 #1 Hardware name: Wiwynn Delta Lake PVT BZA.02601.0150/Delta Lake-Class1, BIOS F0E_3A12 08/26/2021 RIP: 0010:bnxt_rx_pkt+0xe97/0x1ae0 [bnxt_en] Code: 8b 95 70 ff ff ff 4c 8b 9d 48 ff ff ff 66 41 89 87 b4 00 00 00 e9 0b f7 ff ff 0f b7 43 0a 49 8b 95 a8 04 00 00 25 ff 0f 00 00 <0f> b7 14 42 48 c1 e2 06 49 03 95 a0 04 00 00 0f b6 42 33f RSP: 0018:ffffa19f40cc0d18 EFLAGS: 00010202 RAX: 00000000000001e0 RBX: ffff8e2c805c6100 RCX: 00000000000007ff RDX: 0000000000000000 RSI: ffff8e2c271ab990 RDI: ffff8e2c84f12380 RBP: ffffa19f40cc0e48 R08: 000000000001000d R09: 974ea2fcddfa4cbf R10: 0000000000000000 R11: ffffa19f40cc0ff8 R12: ffff8e2c94b58980 R13: ffff8e2c952d6600 R14: 0000000000000016 R15: ffff8e2c271ab990 FS: 0000000000000000(0000) GS:ffff8e3b3f840000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00000000000003c0 CR3: 0000000e8580a004 CR4: 00000000007706e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 PKRU: 55555554 Call Trace: <IRQ> __bnxt_poll_work+0x1c2/0x3e0 [bnxt_en]
To address the issue, we now call bnxt_set_rx_skb_mode() within bnxt_change_mtu() to properly set the AGG rings configuration and update rx_skb_func based on the new MTU value. Additionally, BNXT_FLAG_NO_AGG_RINGS is cleared at the beginning of bnxt_set_rx_skb_mode() to make sure it gets set or cleared based on the current MTU.
CVSS Details
- CVSS 3.1 Base Score: 9.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade linux-6.1Upgrade linux | May 15, 2025 | Dec 27, 2024 |
| Oracle_linux | — | Upgrade kernel-uek | Apr 15, 2025 | Dec 27, 2024 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Dec 27, 2024 |
| Ubuntu | — | Upgrade linux-image-realtimeUpgrade linux-image-azure-lts-24.04Upgrade linux-image-azure-fdeUpgrade linux-image-6.8.0-1014-azure-nvidiaUpgrade linux-image-oem-22.04bUpgrade linux-image-6.8.0-1028-gcp-64kUpgrade linux-image-6.11.0-1011-oracleUpgrade linux-image-6.11.0-1005-realtimeUpgrade linux-image-6.8.0-1026-oemUpgrade linux-image-generic-hwe-22.04Upgrade linux-image-6.11.0-1015-oemUpgrade linux-image-gcpUpgrade linux-image-6.8.0-1027-awsUpgrade linux-image-generic-hwe-24.04Upgrade linux-image-azure-fde-lts-24.04Upgrade linux-image-virtual-hwe-22.04Upgrade linux-image-awsUpgrade linux-image-virtual-hwe-24.04Upgrade linux-image-nvidia-64kUpgrade linux-image-ibm-lts-24.04Upgrade linux-image-generic-64k-hwe-24.04Upgrade linux-image-azure-nvidiaUpgrade linux-image-oracleUpgrade linux-image-raspi-realtimeUpgrade linux-image-6.11.0-1010-lowlatencyUpgrade linux-image-ibm-classicUpgrade linux-image-kvmUpgrade linux-image-6.8.0-1023-gkeUpgrade linux-image-aws-lts-24.04Upgrade linux-image-6.8.0-58-generic-64kUpgrade linux-image-oem-22.04dUpgrade linux-image-6.8.0-1027-azure-fdeUpgrade linux-image-azureUpgrade linux-image-oracle-64k-lts-24.04Upgrade linux-image-6.11.0-1010-lowlatency-64kUpgrade linux-image-oem-24.04aUpgrade linux-image-6.8.0-1010-gkeopUpgrade linux-image-oracle-64kUpgrade linux-image-gcp-lts-24.04Upgrade linux-image-6.11.0-1011-oracle-64kUpgrade linux-image-6.8.0-58-lowlatency-64kUpgrade linux-image-virtualUpgrade linux-image-6.8.0-1026-nvidia-64kUpgrade linux-image-generic-lpaeUpgrade linux-image-6.8.1-1020-realtimeUpgrade linux-image-6.8.0-1027-azureUpgrade linux-image-6.8.0-1026-nvidia-lowlatencyUpgrade linux-image-gkeopUpgrade linux-image-6.8.0-1028-gcpUpgrade linux-image-gcp-64kUpgrade linux-image-oracle-lts-24.04Upgrade linux-image-6.11.0-1009-azure-fdeUpgrade linux-image-oem-24.04bUpgrade linux-image-realtime-hwe-24.04Upgrade linux-image-6.8.0-1024-oracleUpgrade linux-image-nvidia-lowlatencyUpgrade linux-image-gkeUpgrade linux-image-oem-22.04Upgrade linux-image-lowlatency-hwe-22.04Upgrade linux-image-generic-64kUpgrade linux-image-6.8.0-1028-raspiUpgrade linux-image-lowlatency-64kUpgrade linux-image-6.8.0-58-lowlatencyUpgrade linux-image-genericUpgrade linux-image-nvidia-lowlatency-64kUpgrade linux-image-nvidia-6.8Upgrade linux-image-generic-64k-hwe-22.04Upgrade linux-image-6.8.0-2023-raspi-realtimeUpgrade linux-image-nvidia-64k-hwe-22.04Upgrade linux-image-6.8.0-1024-oracle-64kUpgrade linux-image-6.11.0-1009-gcpUpgrade linux-image-lowlatency-64k-hwe-22.04Upgrade linux-image-6.11.0-18-genericUpgrade linux-image-lowlatencyUpgrade linux-image-nvidia-hwe-22.04Upgrade linux-image-ibmUpgrade linux-image-6.8.0-1026-nvidiaUpgrade linux-image-6.11.0-1009-azureUpgrade linux-image-oem-22.04cUpgrade linux-image-6.11.0-1009-awsUpgrade linux-image-nvidia-64k-6.8Upgrade linux-image-6.11.0-18-generic-64kUpgrade linux-image-oem-24.04Upgrade linux-image-6.8.0-1026-nvidia-lowlatency-64kUpgrade linux-image-6.8.0-1024-ibmUpgrade linux-image-6.11.0-1008-raspiUpgrade linux-image-6.8.0-58-genericUpgrade linux-image-raspiUpgrade linux-image-gcp-64k-lts-24.04Upgrade linux-image-nvidiaUpgrade linux-image-oem-22.04aUpgrade linux-image-gkeop-6.8 | Feb 20, 2025 | Dec 27, 2024 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Sep 22, 2025 | Dec 27, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub