In the Linux kernel, the following vulnerability has been resolved:
eth: bnxt: fix truesize for mb-xdp-pass case
When mb-xdp is set and return is XDP_PASS, packet is converted from xdp_buff to sk_buff with xdp_update_skb_shared_info() in bnxt_xdp_build_skb(). bnxt_xdp_build_skb() passes incorrect truesize argument to xdp_update_skb_shared_info(). The truesize is calculated as BNXT_RX_PAGE_SIZE * sinfo->nr_frags but the skb_shared_info was wiped by napi_build_skb() before. So it stores sinfo->nr_frags before bnxt_xdp_build_skb() and use it instead of getting skb_shared_info from xdp_get_shared_info_from_buff().
Splat looks like: ------------[ cut here ]------------ WARNING: CPU: 2 PID: 0 at net/core/skbuff.c:6072 skb_try_coalesce+0x504/0x590 Modules linked in: xt_nat xt_tcpudp veth af_packet xt_conntrack nft_chain_nat xt_MASQUERADE nf_conntrack_netlink xfrm_user xt_addrtype nft_coms CPU: 2 UID: 0 PID: 0 Comm: swapper/2 Not tainted 6.14.0-rc2+ #3 RIP: 0010:skb_try_coalesce+0x504/0x590 Code: 4b fd ff ff 49 8b 34 24 40 80 e6 40 0f 84 3d fd ff ff 49 8b 74 24 48 40 f6 c6 01 0f 84 2e fd ff ff 48 8d 4e ff e9 25 fd ff ff <0f> 0b e99 RSP: 0018:ffffb62c4120caa8 EFLAGS: 00010287 RAX: 0000000000000003 RBX: ffffb62c4120cb14 RCX: 0000000000000ec0 RDX: 0000000000001000 RSI: ffffa06e5d7dc000 RDI: 0000000000000003 RBP: ffffa06e5d7ddec0 R08: ffffa06e6120a800 R09: ffffa06e7a119900 R10: 0000000000002310 R11: ffffa06e5d7dcec0 R12: ffffe4360575f740 R13: ffffe43600000000 R14: 0000000000000002 R15: 0000000000000002 FS: 0000000000000000(0000) GS:ffffa0755f700000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f147b76b0f8 CR3: 00000001615d4000 CR4: 00000000007506f0 PKRU: 55555554 Call Trace: <IRQ> ? __warn+0x84/0x130 ? skb_try_coalesce+0x504/0x590 ? report_bug+0x18a/0x1a0 ? handle_bug+0x53/0x90 ? exc_invalid_op+0x14/0x70 ? asm_exc_invalid_op+0x16/0x20 ? skb_try_coalesce+0x504/0x590 inet_frag_reasm_finish+0x11f/0x2e0 ip_defrag+0x37a/0x900 ip_local_deliver+0x51/0x120 ip_sublist_rcv_finish+0x64/0x70 ip_sublist_rcv+0x179/0x210 ip_list_rcv+0xf9/0x130
How to reproduce: <Node A> ip link set $interface1 xdp obj xdp_pass.o ip link set $interface1 mtu 9000 up ip a a 10.0.0.1/24 dev $interface1 <Node B> ip link set $interfac2 mtu 9000 up ip a a 10.0.0.2/24 dev $interface2 ping 10.0.0.1 -s 65000
Following ping.py patch adds xdp-mb-pass case. so ping.py is going to be able to reproduce this issue.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade kernel-rt-debug-develUpgrade kernel-toolsUpgrade kernel-debug-coreUpgrade kernel-docUpgrade kernel-64k-debug-devel-matchedUpgrade kernel-rt-64k-modules-extraUpgrade kernel-64k-debug-modules-coreUpgrade kernel-coreUpgrade kernel-uki-virtUpgrade kernel-uki-virt-addonsUpgrade kernel-zfcpdump-coreUpgrade kernel-zfcpdump-devel-matchedUpgrade perfUpgrade libperfUpgrade kernel-develUpgrade kernel-64k-modules-extraUpgrade kernel-rt-modules-coreUpgrade kernel-zfcpdump-modules-extraUpgrade kernel-debugUpgrade kernel-modulesUpgrade kernel-64k-debug-develUpgrade kernel-rtUpgrade kernel-zfcpdump-modulesUpgrade kernel-devel-matchedUpgrade kernel-rt-debug-modulesUpgrade kernel-64k-develUpgrade kernel-debug-modules-extraUpgrade kernel-64k-debug-modulesUpgrade kernel-64k-debug-modules-extraUpgrade kernel-rt-debug-modules-extraUpgrade kernel-zfcpdump-develUpgrade rvUpgrade kernel-rt-debug-modules-coreUpgrade kernel-64k-devel-matchedUpgrade kernel-modules-extraUpgrade kernel-rt-debug-kvmUpgrade kernel-zfcpdumpUpgrade kernel-64k-debugUpgrade kernel-rt-modulesUpgrade kernel-rt-debug-coreUpgrade kernel-rt-64k-debug-modules-extraUpgrade kernelUpgrade kernel-rt-64k-debug-modules-coreUpgrade kernel-rt-64k-develUpgrade kernel-rt-64k-debug-modulesUpgrade kernel-zfcpdump-modules-coreUpgrade kernel-rt-64k-coreUpgrade kernel-debug-devel-matchedUpgrade kernel-debug-uki-virtUpgrade kernel-rt-kvmUpgrade kernel-rt-64kUpgrade kernel-headersUpgrade kernel-rt-debugUpgrade kernel-abi-stablelistsUpgrade kernel-64k-modulesUpgrade kernel-tools-libsUpgrade kernel-rt-64k-modulesUpgrade kernel-modules-coreUpgrade kernel-rt-coreUpgrade kernel-cross-headersUpgrade rtlaUpgrade kernel-debug-modules-coreUpgrade kernel-rt-modules-extraUpgrade kernel-debug-develUpgrade kernel-debug-modulesUpgrade kernel-64k-coreUpgrade kernel-tools-libs-develUpgrade kernel-rt-64k-modules-coreUpgrade kernel-rt-64k-debug-develUpgrade kernel-rt-64k-debug-coreUpgrade kernel-rt-64k-debugUpgrade kernel-rt-develUpgrade kernel-64k-modules-coreUpgrade kernel-64kUpgrade kernel-64k-debug-coreUpgrade python3-perf | Jul 4, 2025 | Apr 1, 2025 |
| Debian | — | No solution existsUpgrade linux | May 15, 2025 | Apr 1, 2025 |
| Oracle_linux | — | Upgrade kernel | Jun 30, 2025 | Apr 1, 2025 |
| Redhat_linux | — | No solution existsUpgrade kernel-rtUpgrade kernel | Jun 17, 2025 | Apr 1, 2025 |
| Rocky_linux | — | Upgrade kernel-uki-virtUpgrade kernel-rt-debugUpgrade kernel-rt-debug-develUpgrade kernel-debug-develUpgrade kernel-zfcpdump-modules-extraUpgrade kernel-rt-coreUpgrade kernel-debug-coreUpgrade kernel-debug-modules-coreUpgrade kernel-zfcpdumpUpgrade kernel-cross-headersUpgrade python3-perfUpgrade kernel-rt-debug-kvmUpgrade kernel-tools-debuginfoUpgrade python3-perf-debuginfoUpgrade kernel-modules-coreUpgrade kernel-rt-develUpgrade libperfUpgrade kernel-coreUpgrade kernel-zfcpdump-develUpgrade kernel-debugUpgrade kernel-debug-uki-virtUpgrade kernel-tools-libsUpgrade kernel-debuginfoUpgrade kernel-rt-debug-modulesUpgrade kernel-develUpgrade rtlaUpgrade perfUpgrade kernel-modules-extraUpgrade perf-debuginfoUpgrade kernel-zfcpdump-debuginfoUpgrade kernel-headersUpgrade kernel-rt-debug-modules-extraUpgrade kernelUpgrade kernel-modulesUpgrade kernel-zfcpdump-devel-matchedUpgrade kernel-uki-virt-addonsUpgrade kernel-rt-debuginfoUpgrade kernel-rt-modules-coreUpgrade kernel-toolsUpgrade kernel-debug-devel-matchedUpgrade kernel-rt-modulesUpgrade kernel-debug-debuginfoUpgrade kernel-zfcpdump-modulesUpgrade kernel-rt-debug-modules-coreUpgrade kernel-debug-modulesUpgrade kernel-zfcpdump-modules-coreUpgrade kernel-rt-debug-coreUpgrade kernel-rt-debug-debuginfoUpgrade kernel-tools-libs-develUpgrade kernel-zfcpdump-coreUpgrade libperf-debuginfoUpgrade kernel-rtUpgrade kernel-debug-modules-extraUpgrade kernel-rt-kvmUpgrade kernel-rt-modules-extraUpgrade rvUpgrade kernel-devel-matched | Oct 6, 2025 | Oct 4, 2025 |
| Suse | — | Upgrade kernel-64kb-extraUpgrade dtb-socionextUpgrade kernel-rt-livepatch-develUpgrade kernel-kvmsmallUpgrade kernel-rt-extraUpgrade kselftests-kmp-rtUpgrade dtb-lgUpgrade reiserfs-kmp-rtUpgrade kernel-devel-azureUpgrade kernel-syms-azureUpgrade kernel-rt-optionalUpgrade kernel-rt-vdsoUpgrade kselftests-kmp-azureUpgrade kernel-azure-develUpgrade kernel-azure-vdsoUpgrade kernel-docs-htmlUpgrade kernel-source-azureUpgrade gfs2-kmp-defaultUpgrade kernel-rt_debug-develUpgrade dtb-appleUpgrade cluster-md-kmp-defaultUpgrade kernel-default-develUpgrade kernel-rt_debug-vdsoUpgrade kernel-source-vanillaUpgrade kernel-kvmsmall-vdsoUpgrade reiserfs-kmp-64kbUpgrade kernel-default-livepatchUpgrade dtb-amazonUpgrade dlm-kmp-rtUpgrade dtb-amlogicUpgrade kernel-source-rtUpgrade ocfs2-kmp-64kbUpgrade kernel-azure-optionalUpgrade dlm-kmp-defaultUpgrade kernel-debug-vdsoUpgrade dtb-amdUpgrade dtb-freescaleUpgrade dtb-alteraUpgrade kernel-64kbUpgrade dtb-marvellUpgrade dtb-sprdUpgrade kernel-azureUpgrade kernel-azure-extraUpgrade kernel-syms-rtUpgrade dlm-kmp-64kbUpgrade dtb-broadcomUpgrade kernel-macrosUpgrade kernel-rt_debugUpgrade cluster-md-kmp-64kbUpgrade kernel-obs-buildUpgrade kernel-rtUpgrade kernel-rt-develUpgrade kernel-default-vdsoUpgrade dlm-kmp-azureUpgrade kernel-obs-qaUpgrade kernel-kvmsmall-develUpgrade dtb-exynosUpgrade reiserfs-kmp-defaultUpgrade kernel-zfcpdumpUpgrade kernel-docsUpgrade kernel-defaultUpgrade kernel-default-livepatch-develUpgrade kernel-64kb-optionalUpgrade gfs2-kmp-azureUpgrade ocfs2-kmp-azureUpgrade dtb-qcomUpgrade dtb-apmUpgrade ocfs2-kmp-defaultUpgrade dtb-rockchipUpgrade kernel-debug-develUpgrade kernel-64kb-develUpgrade kernel-default-base-rebuildUpgrade ocfs2-kmp-rtUpgrade kernel-sourceUpgrade kernel-default-optionalUpgrade kernel-default-baseUpgrade kernel-debugUpgrade gfs2-kmp-64kbUpgrade dtb-renesasUpgrade dtb-armUpgrade gfs2-kmp-rtUpgrade dtb-allwinnerUpgrade kernel-symsUpgrade kernel-default-extraUpgrade reiserfs-kmp-azureUpgrade dtb-xilinxUpgrade kselftests-kmp-defaultUpgrade kselftests-kmp-64kbUpgrade kernel-devel-rtUpgrade dtb-caviumUpgrade cluster-md-kmp-rtUpgrade kernel-develUpgrade cluster-md-kmp-azureUpgrade dtb-nvidiaUpgrade dtb-mediatekUpgrade dtb-hisilicon | Dec 5, 2025 | Jun 19, 2025 |
| Ubuntu | — | Upgrade linux-image-realtime-hwe-22.04Upgrade linux-image-raspi-realtime-6.8Upgrade linux-image-oracle-64k-6.8Upgrade linux-image-lowlatency-hwe-22.04Upgrade linux-image-nvidia-64k-hwe-22.04Upgrade linux-image-azure-nvidia-lts-24.04Upgrade linux-image-nvidia-lowlatency-64k-6.8Upgrade linux-image-generic-64k-hwe-22.04Upgrade linux-image-6.8.0-85-genericUpgrade linux-image-oem-22.04aUpgrade linux-image-6.8.0-1037-oracle-64kUpgrade linux-image-azure-6.8Upgrade linux-image-6.11.0-1017-oracleUpgrade linux-image-lowlatencyUpgrade linux-image-oem-24.04bUpgrade linux-image-genericUpgrade linux-image-virtual-hwe-22.04Upgrade linux-image-6.8.0-1039-nvidia-lowlatencyUpgrade linux-image-6.8.0-1040-gcp-64kUpgrade linux-image-virtualUpgrade linux-image-6.8.1-1034-realtimeUpgrade linux-image-nvidiaUpgrade linux-image-lowlatency-6.8Upgrade linux-image-nvidia-hwe-22.04Upgrade linux-image-gcp-64kUpgrade linux-image-azure-nvidia-6.8Upgrade linux-image-virtual-hwe-24.04Upgrade linux-image-aws-6.8Upgrade linux-image-6.8.0-1036-azureUpgrade linux-image-6.8.0-2031-raspi-realtimeUpgrade linux-image-6.11.0-1015-awsUpgrade linux-image-azure-fde-6.8Upgrade linux-image-6.8.0-84-lowlatency-64kUpgrade linux-image-lowlatency-64kUpgrade linux-image-lowlatency-64k-hwe-22.04Upgrade linux-image-generic-64kUpgrade linux-image-nvidia-6.8Upgrade linux-image-generic-lpaeUpgrade linux-image-oem-22.04dUpgrade linux-image-raspi-6.8Upgrade linux-image-realtime-6.8.1Upgrade linux-image-6.8.0-1039-nvidiaUpgrade linux-image-nvidia-lowlatency-6.8Upgrade linux-image-6.11.0-1024-oemUpgrade linux-image-gke-6.8Upgrade linux-image-aws-64kUpgrade linux-image-6.11.0-1011-realtimeUpgrade linux-image-oracle-lts-24.04Upgrade linux-image-gkeUpgrade linux-image-gcp-64k-6.8Upgrade linux-image-gcp-64k-lts-24.04Upgrade linux-image-6.8.0-1038-azure-fdeUpgrade linux-image-lowlatency-hwe-24.04Upgrade linux-image-6.8.0-1036-azure-fdeUpgrade linux-image-oem-22.04Upgrade linux-image-6.8.0-1039-raspiUpgrade linux-image-6.8.0-1038-azureUpgrade linux-image-oem-22.04cUpgrade linux-image-6.11.0-1014-raspiUpgrade linux-image-6.8.0-1036-gkeUpgrade linux-image-gkeopUpgrade linux-image-lowlatency-64k-6.8Upgrade linux-image-6.8.0-1025-azure-nvidiaUpgrade linux-image-nvidia-64k-6.8Upgrade linux-image-oracleUpgrade linux-image-ibm-6.8Upgrade linux-image-ibm-lts-24.04Upgrade linux-image-gcp-6.8Upgrade linux-image-awsUpgrade linux-image-6.11.0-1018-azureUpgrade linux-image-oracle-6.8Upgrade linux-image-azureUpgrade linux-image-aws-64k-6.8Upgrade linux-image-azure-nvidiaUpgrade linux-image-realtimeUpgrade linux-image-6.8.0-1037-oracleUpgrade linux-image-gke-64kUpgrade linux-image-ibmUpgrade linux-image-nvidia-lowlatency-64kUpgrade linux-image-6.8.0-85-generic-64kUpgrade linux-image-lowlatency-64k-hwe-24.04Upgrade linux-image-ibm-classicUpgrade linux-image-virtual-6.8Upgrade linux-image-kvmUpgrade linux-image-6.11.0-1015-lowlatency-64kUpgrade linux-image-aws-lts-24.04Upgrade linux-image-generic-64k-6.8Upgrade linux-image-nvidia-64kUpgrade linux-image-lowlatency-64k-6.11Upgrade linux-image-gkeop-6.8Upgrade linux-image-generic-hwe-24.04Upgrade linux-image-aws-64k-lts-24.04Upgrade linux-image-6.8.0-1040-gcpUpgrade linux-image-6.8.0-1037-ibmUpgrade linux-image-6.11.0-28-generic-64kUpgrade linux-image-oracle-64kUpgrade linux-image-6.8.0-1039-awsUpgrade linux-image-6.11.0-1017-oracle-64kUpgrade linux-image-6.11.0-1016-gcp-64kUpgrade linux-image-6.8.0-1036-gke-64kUpgrade linux-image-azure-fde-6.11Upgrade linux-image-azure-fde-edgeUpgrade linux-image-6.11.0-1018-azure-fdeUpgrade linux-image-6.11.0-1015-lowlatencyUpgrade linux-image-generic-6.8Upgrade linux-image-raspiUpgrade linux-image-raspi-realtimeUpgrade linux-image-nvidia-lowlatencyUpgrade linux-image-generic-64k-hwe-24.04Upgrade linux-image-6.8.0-84-lowlatencyUpgrade linux-image-6.8.0-84-genericUpgrade linux-image-6.8.0-1039-nvidia-64kUpgrade linux-image-6.8.0-1039-nvidia-lowlatency-64kUpgrade linux-image-6.8.0-1039-aws-64kUpgrade linux-image-6.11.0-1016-gcpUpgrade linux-image-oem-22.04bUpgrade linux-image-oracle-64k-lts-24.04Upgrade linux-image-lowlatency-6.11Upgrade linux-image-azure-fdeUpgrade linux-image-gke-64k-6.8Upgrade linux-image-gcp-lts-24.04Upgrade linux-image-azure-fde-lts-24.04Upgrade linux-image-6.8.0-84-generic-64kUpgrade linux-image-6.8.0-1023-gkeopUpgrade linux-image-generic-hwe-22.04Upgrade linux-image-6.11.0-28-genericUpgrade linux-image-gcpUpgrade linux-image-azure-lts-24.04Upgrade linux-image-azure-6.11 | Jun 26, 2025 | Apr 1, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub