In the Linux kernel, the following vulnerability has been resolved:
eth: bnxt: fix truesize for mb-xdp-pass case
When mb-xdp is set and return is XDP_PASS, packet is converted from xdp_buff to sk_buff with xdp_update_skb_shared_info() in bnxt_xdp_build_skb(). bnxt_xdp_build_skb() passes incorrect truesize argument to xdp_update_skb_shared_info(). The truesize is calculated as BNXT_RX_PAGE_SIZE * sinfo->nr_frags but the skb_shared_info was wiped by napi_build_skb() before. So it stores sinfo->nr_frags before bnxt_xdp_build_skb() and use it instead of getting skb_shared_info from xdp_get_shared_info_from_buff().
Splat looks like: ------------[ cut here ]------------ WARNING: CPU: 2 PID: 0 at net/core/skbuff.c:6072 skb_try_coalesce+0x504/0x590 Modules linked in: xt_nat xt_tcpudp veth af_packet xt_conntrack nft_chain_nat xt_MASQUERADE nf_conntrack_netlink xfrm_user xt_addrtype nft_coms CPU: 2 UID: 0 PID: 0 Comm: swapper/2 Not tainted 6.14.0-rc2+ #3 RIP: 0010:skb_try_coalesce+0x504/0x590 Code: 4b fd ff ff 49 8b 34 24 40 80 e6 40 0f 84 3d fd ff ff 49 8b 74 24 48 40 f6 c6 01 0f 84 2e fd ff ff 48 8d 4e ff e9 25 fd ff ff <0f> 0b e99 RSP: 0018:ffffb62c4120caa8 EFLAGS: 00010287 RAX: 0000000000000003 RBX: ffffb62c4120cb14 RCX: 0000000000000ec0 RDX: 0000000000001000 RSI: ffffa06e5d7dc000 RDI: 0000000000000003 RBP: ffffa06e5d7ddec0 R08: ffffa06e6120a800 R09: ffffa06e7a119900 R10: 0000000000002310 R11: ffffa06e5d7dcec0 R12: ffffe4360575f740 R13: ffffe43600000000 R14: 0000000000000002 R15: 0000000000000002 FS: 0000000000000000(0000) GS:ffffa0755f700000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f147b76b0f8 CR3: 00000001615d4000 CR4: 00000000007506f0 PKRU: 55555554 Call Trace: <IRQ> ? __warn+0x84/0x130 ? skb_try_coalesce+0x504/0x590 ? report_bug+0x18a/0x1a0 ? handle_bug+0x53/0x90 ? exc_invalid_op+0x14/0x70 ? asm_exc_invalid_op+0x16/0x20 ? skb_try_coalesce+0x504/0x590 inet_frag_reasm_finish+0x11f/0x2e0 ip_defrag+0x37a/0x900 ip_local_deliver+0x51/0x120 ip_sublist_rcv_finish+0x64/0x70 ip_sublist_rcv+0x179/0x210 ip_list_rcv+0xf9/0x130
How to reproduce: <Node A> ip link set $interface1 xdp obj xdp_pass.o ip link set $interface1 mtu 9000 up ip a a 10.0.0.1/24 dev $interface1 <Node B> ip link set $interfac2 mtu 9000 up ip a a 10.0.0.2/24 dev $interface2 ping 10.0.0.1 -s 65000
Following ping.py patch adds xdp-mb-pass case. so ping.py is going to be able to reproduce this issue.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade kernel-rt-debug-coreUpgrade kernel-rt-modules-extraUpgrade kernel-debug-modulesUpgrade kernel-rt-64k-debug-develUpgrade kernel-rt-debugUpgrade kernel-rt-64kUpgrade kernel-64k-modulesUpgrade kernel-debug-develUpgrade kernel-debug-uki-virtUpgrade kernel-tools-libsUpgrade kernel-tools-libs-develUpgrade kernel-64k-coreUpgrade kernel-abi-stablelistsUpgrade kernel-rt-64k-debug-modules-extraUpgrade kernel-modules-coreUpgrade kernel-rt-64k-debug-modulesUpgrade kernel-debug-devel-matchedUpgrade kernelUpgrade kernel-cross-headersUpgrade python3-perfUpgrade kernel-rt-64k-coreUpgrade kernel-zfcpdump-modules-coreUpgrade kernel-headersUpgrade kernel-rt-64k-modulesUpgrade kernel-rt-64k-modules-coreUpgrade rtlaUpgrade kernel-rt-64k-debug-coreUpgrade kernel-debug-modules-coreUpgrade kernel-rt-kvmUpgrade kernel-64k-modules-coreUpgrade kernel-64k-debug-coreUpgrade kernel-rt-develUpgrade kernel-rt-64k-debugUpgrade kernel-rt-coreUpgrade kernel-64kUpgrade kernel-rt-64k-debug-modules-coreUpgrade kernel-rt-64k-develUpgrade libperfUpgrade kernel-rt-debug-modulesUpgrade kernel-rt-debug-modules-extraUpgrade kernel-rtUpgrade kernel-debugUpgrade kernel-rt-debug-develUpgrade kernel-docUpgrade kernel-debug-coreUpgrade kernel-toolsUpgrade kernel-devel-matchedUpgrade kernel-uki-virt-addonsUpgrade kernel-64k-debug-develUpgrade kernel-zfcpdumpUpgrade kernel-rt-modules-coreUpgrade kernel-zfcpdump-develUpgrade kernel-64k-debug-devel-matchedUpgrade kernel-64k-modules-extraUpgrade kernel-zfcpdump-modules-extraUpgrade kernel-64k-debug-modules-coreUpgrade kernel-64k-devel-matchedUpgrade rvUpgrade kernel-64k-debugUpgrade kernel-rt-debug-modules-coreUpgrade kernel-modules-extraUpgrade kernel-64k-debug-modules-extraUpgrade kernel-rt-64k-modules-extraUpgrade kernel-coreUpgrade kernel-modulesUpgrade kernel-rt-debug-kvmUpgrade kernel-rt-modulesUpgrade kernel-64k-develUpgrade kernel-64k-debug-modulesUpgrade kernel-zfcpdump-modulesUpgrade kernel-debug-modules-extraUpgrade kernel-develUpgrade kernel-uki-virtUpgrade kernel-zfcpdump-devel-matchedUpgrade perfUpgrade kernel-zfcpdump-core | Jul 4, 2025 | Apr 1, 2025 |
| Debian | — | Upgrade linuxNo solution exists | May 15, 2025 | Apr 1, 2025 |
| Oracle_linux | — | Upgrade kernel | Jun 30, 2025 | Apr 1, 2025 |
| Redhat_linux | — | No solution existsUpgrade kernel-rtUpgrade kernel | Jun 17, 2025 | Apr 1, 2025 |
| Rocky_linux | — | Upgrade kernel-rt-debug-kvmUpgrade kernel-rt-develUpgrade kernel-zfcpdumpUpgrade kernel-zfcpdump-modules-extraUpgrade python3-perfUpgrade kernel-cross-headersUpgrade kernel-debug-develUpgrade kernel-modules-coreUpgrade kernel-debug-modules-coreUpgrade perf-debuginfoUpgrade kernel-modulesUpgrade kernel-uki-virtUpgrade kernel-debug-coreUpgrade kernel-rt-debug-develUpgrade kernel-zfcpdump-debuginfoUpgrade kernel-zfcpdump-develUpgrade kernel-develUpgrade kernel-rt-coreUpgrade libperfUpgrade kernel-debuginfoUpgrade kernel-modules-extraUpgrade kernel-rt-debug-modules-extraUpgrade kernel-rt-debug-modulesUpgrade kernel-debugUpgrade kernel-debug-uki-virtUpgrade kernel-headersUpgrade kernel-coreUpgrade kernel-rt-debugUpgrade python3-perf-debuginfoUpgrade kernel-tools-debuginfoUpgrade rtlaUpgrade kernelUpgrade kernel-tools-libsUpgrade perfUpgrade kernel-rt-debuginfoUpgrade kernel-rt-debug-modules-coreUpgrade kernel-zfcpdump-devel-matchedUpgrade kernel-uki-virt-addonsUpgrade kernel-rt-modules-extraUpgrade kernel-debug-modulesUpgrade kernel-debug-debuginfoUpgrade kernel-debug-devel-matchedUpgrade kernel-zfcpdump-modulesUpgrade kernel-devel-matchedUpgrade rvUpgrade libperf-debuginfoUpgrade kernel-rt-kvmUpgrade kernel-debug-modules-extraUpgrade kernel-tools-libs-develUpgrade kernel-zfcpdump-coreUpgrade kernel-rtUpgrade kernel-rt-modulesUpgrade kernel-toolsUpgrade kernel-rt-debug-debuginfoUpgrade kernel-zfcpdump-modules-coreUpgrade kernel-rt-debug-coreUpgrade kernel-rt-modules-core | Oct 6, 2025 | Oct 4, 2025 |
| Suse | — | Upgrade dtb-rockchipUpgrade kernel-debug-develUpgrade dtb-apmUpgrade gfs2-kmp-azureUpgrade kernel-develUpgrade kernel-devel-rtUpgrade cluster-md-kmp-rtUpgrade kernel-obs-qaUpgrade dlm-kmp-azureUpgrade dtb-mediatekUpgrade dtb-caviumUpgrade kselftests-kmp-defaultUpgrade dtb-nvidiaUpgrade gfs2-kmp-rtUpgrade kernel-default-base-rebuildUpgrade kernel-defaultUpgrade kselftests-kmp-64kbUpgrade kernel-64kb-optionalUpgrade kernel-zfcpdumpUpgrade reiserfs-kmp-defaultUpgrade dtb-hisiliconUpgrade kernel-symsUpgrade kernel-default-livepatch-develUpgrade kernel-sourceUpgrade kernel-docsUpgrade dtb-armUpgrade dtb-renesasUpgrade dtb-exynosUpgrade cluster-md-kmp-azureUpgrade dtb-allwinnerUpgrade dtb-xilinxUpgrade kernel-default-extraUpgrade reiserfs-kmp-azureUpgrade kernel-default-baseUpgrade gfs2-kmp-64kbUpgrade kernel-debugUpgrade ocfs2-kmp-rtUpgrade ocfs2-kmp-defaultUpgrade kernel-rt-develUpgrade ocfs2-kmp-azureUpgrade kernel-default-optionalUpgrade kernel-kvmsmall-develUpgrade dtb-qcomUpgrade kernel-64kb-develUpgrade kernel-default-vdsoUpgrade kernel-azure-optionalUpgrade kernel-syms-azureUpgrade kernel-default-develUpgrade kernel-kvmsmall-vdsoUpgrade dtb-amazonUpgrade kernel-obs-buildUpgrade kernel-source-azureUpgrade dtb-lgUpgrade dtb-broadcomUpgrade dlm-kmp-64kbUpgrade kernel-rt_debug-develUpgrade kernel-kvmsmallUpgrade kernel-docs-htmlUpgrade kernel-azure-develUpgrade dtb-marvellUpgrade dtb-socionextUpgrade kernel-64kbUpgrade kernel-syms-rtUpgrade kernel-azure-extraUpgrade kernel-azureUpgrade kernel-rt-extraUpgrade kselftests-kmp-rtUpgrade kselftests-kmp-azureUpgrade dtb-sprdUpgrade gfs2-kmp-defaultUpgrade dlm-kmp-defaultUpgrade dtb-amdUpgrade dtb-alteraUpgrade ocfs2-kmp-64kbUpgrade kernel-source-rtUpgrade kernel-debug-vdsoUpgrade dtb-freescaleUpgrade kernel-64kb-extraUpgrade cluster-md-kmp-64kbUpgrade kernel-rt_debugUpgrade kernel-rtUpgrade kernel-macrosUpgrade kernel-rt-livepatch-develUpgrade dtb-appleUpgrade kernel-source-vanillaUpgrade kernel-rt_debug-vdsoUpgrade cluster-md-kmp-defaultUpgrade reiserfs-kmp-64kbUpgrade kernel-default-livepatchUpgrade dlm-kmp-rtUpgrade dtb-amlogicUpgrade reiserfs-kmp-rtUpgrade kernel-azure-vdsoUpgrade kernel-rt-vdsoUpgrade kernel-rt-optionalUpgrade kernel-devel-azure | Dec 5, 2025 | Jun 19, 2025 |
| Ubuntu | — | Upgrade linux-image-oracle-64k-lts-24.04Upgrade linux-image-6.11.0-1015-lowlatencyUpgrade linux-image-6.11.0-1018-azure-fdeUpgrade linux-image-6.8.0-84-generic-64kUpgrade linux-image-6.11.0-28-genericUpgrade linux-image-6.8.0-1023-gkeopUpgrade linux-image-ibm-lts-24.04Upgrade linux-image-gke-64kUpgrade linux-image-raspiUpgrade linux-image-6.11.0-1017-oracle-64kUpgrade linux-image-6.8.0-1039-nvidia-64kUpgrade linux-image-generic-6.8Upgrade linux-image-nvidia-lowlatencyUpgrade linux-image-aws-64k-6.8Upgrade linux-image-azure-nvidiaUpgrade linux-image-gcp-6.8Upgrade linux-image-awsUpgrade linux-image-azure-fde-6.11Upgrade linux-image-oracle-64kUpgrade linux-image-6.11.0-1018-azureUpgrade linux-image-6.11.0-1016-gcpUpgrade linux-image-oracle-6.8Upgrade linux-image-ibm-6.8Upgrade linux-image-gkeop-6.8Upgrade linux-image-azure-fde-edgeUpgrade linux-image-nvidia-64kUpgrade linux-image-6.8.0-1025-azure-nvidiaUpgrade linux-image-6.8.0-1037-ibmUpgrade linux-image-generic-hwe-24.04Upgrade linux-image-6.8.0-1039-awsUpgrade linux-image-6.8.0-1036-gke-64kUpgrade linux-image-6.11.0-28-generic-64kUpgrade linux-image-6.11.0-1016-gcp-64kUpgrade linux-image-lowlatency-64k-6.11Upgrade linux-image-gcpUpgrade linux-image-6.8.0-1040-gcpUpgrade linux-image-aws-64k-lts-24.04Upgrade linux-image-realtimeUpgrade linux-image-gke-64k-6.8Upgrade linux-image-6.8.0-1037-oracleUpgrade linux-image-azure-6.11Upgrade linux-image-6.8.0-85-generic-64kUpgrade linux-image-kvmUpgrade linux-image-azure-lts-24.04Upgrade linux-image-gcp-lts-24.04Upgrade linux-image-ibm-classicUpgrade linux-image-6.11.0-1015-lowlatency-64kUpgrade linux-image-generic-64k-6.8Upgrade linux-image-nvidia-lowlatency-64kUpgrade linux-image-ibmUpgrade linux-image-6.8.0-1039-aws-64kUpgrade linux-image-raspi-realtimeUpgrade linux-image-aws-lts-24.04Upgrade linux-image-lowlatency-64k-hwe-24.04Upgrade linux-image-oracleUpgrade linux-image-6.8.0-84-lowlatencyUpgrade linux-image-oem-22.04bUpgrade linux-image-generic-64k-hwe-24.04Upgrade linux-image-generic-hwe-22.04Upgrade linux-image-lowlatency-6.11Upgrade linux-image-nvidia-64k-6.8Upgrade linux-image-6.8.0-84-genericUpgrade linux-image-6.8.0-1039-nvidia-lowlatency-64kUpgrade linux-image-azure-fdeUpgrade linux-image-azure-fde-lts-24.04Upgrade linux-image-virtual-6.8Upgrade linux-image-azureUpgrade linux-image-lowlatency-hwe-22.04Upgrade linux-image-oem-24.04bUpgrade linux-image-6.8.0-85-genericUpgrade linux-image-realtime-6.8.1Upgrade linux-image-raspi-6.8Upgrade linux-image-azure-nvidia-lts-24.04Upgrade linux-image-realtime-hwe-22.04Upgrade linux-image-raspi-realtime-6.8Upgrade linux-image-oem-22.04aUpgrade linux-image-nvidia-64k-hwe-22.04Upgrade linux-image-nvidia-lowlatency-64k-6.8Upgrade linux-image-generic-64k-hwe-22.04Upgrade linux-image-lowlatency-64k-6.8Upgrade linux-image-6.8.0-1036-azure-fdeUpgrade linux-image-gke-6.8Upgrade linux-image-aws-64kUpgrade linux-image-nvidia-lowlatency-6.8Upgrade linux-image-gcp-64k-6.8Upgrade linux-image-lowlatency-hwe-24.04Upgrade linux-image-oracle-lts-24.04Upgrade linux-image-azure-fde-6.8Upgrade linux-image-6.8.0-2031-raspi-realtimeUpgrade linux-image-nvidiaUpgrade linux-image-aws-6.8Upgrade linux-image-6.8.0-1039-nvidiaUpgrade linux-image-6.11.0-1015-awsUpgrade linux-image-lowlatency-6.8Upgrade linux-image-gkeUpgrade linux-image-gcp-64kUpgrade linux-image-6.8.1-1034-realtimeUpgrade linux-image-6.8.0-1040-gcp-64kUpgrade linux-image-6.8.0-1039-nvidia-lowlatencyUpgrade linux-image-6.8.0-1036-gkeUpgrade linux-image-nvidia-hwe-22.04Upgrade linux-image-virtualUpgrade linux-image-6.8.0-1037-oracle-64kUpgrade linux-image-lowlatency-64k-hwe-22.04Upgrade linux-image-lowlatency-64kUpgrade linux-image-generic-64kUpgrade linux-image-6.11.0-1024-oemUpgrade linux-image-6.11.0-1011-realtimeUpgrade linux-image-oem-22.04dUpgrade linux-image-nvidia-6.8Upgrade linux-image-generic-lpaeUpgrade linux-image-oem-22.04cUpgrade linux-image-6.8.0-1036-azureUpgrade linux-image-virtual-hwe-24.04Upgrade linux-image-azure-nvidia-6.8Upgrade linux-image-6.8.0-1038-azure-fdeUpgrade linux-image-gcp-64k-lts-24.04Upgrade linux-image-gkeopUpgrade linux-image-6.8.0-1038-azureUpgrade linux-image-6.8.0-1039-raspiUpgrade linux-image-oem-22.04Upgrade linux-image-6.8.0-84-lowlatency-64kUpgrade linux-image-6.11.0-1014-raspiUpgrade linux-image-virtual-hwe-22.04Upgrade linux-image-genericUpgrade linux-image-azure-6.8Upgrade linux-image-oracle-64k-6.8Upgrade linux-image-lowlatencyUpgrade linux-image-6.11.0-1017-oracle | Jun 26, 2025 | Apr 1, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub