In the Linux kernel, the following vulnerability has been resolved:
eth: bnxt: fix truesize for mb-xdp-pass case
When mb-xdp is set and return is XDP_PASS, packet is converted from xdp_buff to sk_buff with xdp_update_skb_shared_info() in bnxt_xdp_build_skb(). bnxt_xdp_build_skb() passes incorrect truesize argument to xdp_update_skb_shared_info(). The truesize is calculated as BNXT_RX_PAGE_SIZE * sinfo->nr_frags but the skb_shared_info was wiped by napi_build_skb() before. So it stores sinfo->nr_frags before bnxt_xdp_build_skb() and use it instead of getting skb_shared_info from xdp_get_shared_info_from_buff().
Splat looks like: ------------[ cut here ]------------ WARNING: CPU: 2 PID: 0 at net/core/skbuff.c:6072 skb_try_coalesce+0x504/0x590 Modules linked in: xt_nat xt_tcpudp veth af_packet xt_conntrack nft_chain_nat xt_MASQUERADE nf_conntrack_netlink xfrm_user xt_addrtype nft_coms CPU: 2 UID: 0 PID: 0 Comm: swapper/2 Not tainted 6.14.0-rc2+ #3 RIP: 0010:skb_try_coalesce+0x504/0x590 Code: 4b fd ff ff 49 8b 34 24 40 80 e6 40 0f 84 3d fd ff ff 49 8b 74 24 48 40 f6 c6 01 0f 84 2e fd ff ff 48 8d 4e ff e9 25 fd ff ff <0f> 0b e99 RSP: 0018:ffffb62c4120caa8 EFLAGS: 00010287 RAX: 0000000000000003 RBX: ffffb62c4120cb14 RCX: 0000000000000ec0 RDX: 0000000000001000 RSI: ffffa06e5d7dc000 RDI: 0000000000000003 RBP: ffffa06e5d7ddec0 R08: ffffa06e6120a800 R09: ffffa06e7a119900 R10: 0000000000002310 R11: ffffa06e5d7dcec0 R12: ffffe4360575f740 R13: ffffe43600000000 R14: 0000000000000002 R15: 0000000000000002 FS: 0000000000000000(0000) GS:ffffa0755f700000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f147b76b0f8 CR3: 00000001615d4000 CR4: 00000000007506f0 PKRU: 55555554 Call Trace: <IRQ> ? __warn+0x84/0x130 ? skb_try_coalesce+0x504/0x590 ? report_bug+0x18a/0x1a0 ? handle_bug+0x53/0x90 ? exc_invalid_op+0x14/0x70 ? asm_exc_invalid_op+0x16/0x20 ? skb_try_coalesce+0x504/0x590 inet_frag_reasm_finish+0x11f/0x2e0 ip_defrag+0x37a/0x900 ip_local_deliver+0x51/0x120 ip_sublist_rcv_finish+0x64/0x70 ip_sublist_rcv+0x179/0x210 ip_list_rcv+0xf9/0x130
How to reproduce: <Node A> ip link set $interface1 xdp obj xdp_pass.o ip link set $interface1 mtu 9000 up ip a a 10.0.0.1/24 dev $interface1 <Node B> ip link set $interfac2 mtu 9000 up ip a a 10.0.0.2/24 dev $interface2 ping 10.0.0.1 -s 65000
Following ping.py patch adds xdp-mb-pass case. so ping.py is going to be able to reproduce this issue.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade kernel-64k-modules-extraUpgrade kernel-64k-debugUpgrade kernel-docUpgrade kernel-toolsUpgrade kernel-rt-debug-modules-extraUpgrade kernel-64k-debug-modules-extraUpgrade kernel-debugUpgrade kernel-modules-extraUpgrade kernel-zfcpdump-develUpgrade kernel-modulesUpgrade libperfUpgrade kernel-uki-virt-addonsUpgrade kernel-debug-coreUpgrade kernel-develUpgrade kernel-rt-debug-modules-coreUpgrade kernel-rt-debug-modulesUpgrade kernel-rtUpgrade kernel-zfcpdump-modulesUpgrade kernel-devel-matchedUpgrade kernel-64k-devel-matchedUpgrade kernel-debug-modules-extraUpgrade kernel-coreUpgrade kernel-64k-debug-develUpgrade kernel-64k-debug-devel-matchedUpgrade kernel-64k-debug-modulesUpgrade kernel-rt-modules-coreUpgrade kernel-rt-debug-develUpgrade kernel-uki-virtUpgrade rvUpgrade kernel-64k-debug-modules-coreUpgrade kernel-zfcpdump-devel-matchedUpgrade perfUpgrade kernel-zfcpdumpUpgrade kernel-rt-modulesUpgrade kernel-zfcpdump-modules-extraUpgrade kernel-64k-develUpgrade kernel-zfcpdump-coreUpgrade kernel-rt-debug-kvmUpgrade kernel-rt-64k-modules-extraUpgrade kernel-rt-modules-extraUpgrade kernel-rt-64k-develUpgrade kernel-64k-coreUpgrade kernel-rt-64k-modulesUpgrade kernel-64k-modulesUpgrade kernel-debug-devel-matchedUpgrade kernel-rt-64k-debug-modulesUpgrade kernel-rt-64k-debug-modules-extraUpgrade kernel-rt-64k-coreUpgrade kernel-zfcpdump-modules-coreUpgrade kernelUpgrade python3-perfUpgrade kernel-tools-libsUpgrade kernel-abi-stablelistsUpgrade kernel-debug-develUpgrade kernel-rt-64kUpgrade kernel-tools-libs-develUpgrade kernel-rt-debugUpgrade kernel-rt-64k-debugUpgrade kernel-rt-kvmUpgrade kernel-rt-64k-debug-modules-coreUpgrade kernel-rt-64k-modules-coreUpgrade rtlaUpgrade kernel-headersUpgrade kernel-debug-uki-virtUpgrade kernel-rt-64k-debug-coreUpgrade kernel-debug-modulesUpgrade kernel-rt-debug-coreUpgrade kernel-debug-modules-coreUpgrade kernel-rt-coreUpgrade kernel-cross-headersUpgrade kernel-rt-64k-debug-develUpgrade kernel-rt-develUpgrade kernel-64k-modules-coreUpgrade kernel-64k-debug-coreUpgrade kernel-64kUpgrade kernel-modules-core | Jul 4, 2025 | Apr 1, 2025 |
| Debian | — | Upgrade linux | May 15, 2025 | Apr 1, 2025 |
| Oracle_linux | — | Upgrade kernel | Jun 30, 2025 | Apr 1, 2025 |
| Redhat_linux | — | No solution existsUpgrade kernelUpgrade kernel-rt | Jun 17, 2025 | Apr 1, 2025 |
| Rocky_linux | — | Upgrade kernel-modules-coreUpgrade kernel-rt-debugUpgrade kernel-debug-develUpgrade kernel-debug-modules-coreUpgrade kernel-rt-debug-kvmUpgrade perf-debuginfoUpgrade kernel-cross-headersUpgrade kernel-rt-develUpgrade python3-perfUpgrade kernel-develUpgrade kernel-debug-uki-virtUpgrade kernel-headersUpgrade kernel-uki-virtUpgrade kernel-zfcpdump-debuginfoUpgrade libperfUpgrade kernel-coreUpgrade kernel-debugUpgrade python3-perf-debuginfoUpgrade rtlaUpgrade kernel-zfcpdump-modules-extraUpgrade kernel-rt-debug-modules-extraUpgrade kernel-zfcpdump-develUpgrade perfUpgrade kernel-tools-debuginfoUpgrade kernel-zfcpdumpUpgrade kernel-debug-coreUpgrade kernel-debuginfoUpgrade kernel-rt-debug-modulesUpgrade kernel-modulesUpgrade kernel-tools-libsUpgrade kernel-rt-coreUpgrade kernel-rt-debug-develUpgrade kernelUpgrade kernel-modules-extraUpgrade kernel-rt-debug-coreUpgrade kernel-debug-debuginfoUpgrade kernel-debug-devel-matchedUpgrade kernel-rt-debug-modules-coreUpgrade kernel-debug-modulesUpgrade kernel-zfcpdump-modulesUpgrade kernel-zfcpdump-devel-matchedUpgrade kernel-uki-virt-addonsUpgrade kernel-rt-modules-extraUpgrade kernel-rt-modulesUpgrade kernel-rt-modules-coreUpgrade kernel-rt-debuginfoUpgrade kernel-debug-modules-extraUpgrade kernel-zfcpdump-coreUpgrade kernel-tools-libs-develUpgrade kernel-rtUpgrade kernel-rt-kvmUpgrade libperf-debuginfoUpgrade rvUpgrade kernel-devel-matchedUpgrade kernel-zfcpdump-modules-coreUpgrade kernel-toolsUpgrade kernel-rt-debug-debuginfo | Oct 6, 2025 | Oct 4, 2025 |
| Suse | — | Upgrade dtb-hisiliconUpgrade dtb-mediatekUpgrade reiserfs-kmp-azureUpgrade kernel-obs-qaUpgrade gfs2-kmp-azureUpgrade gfs2-kmp-64kbUpgrade dtb-rockchipUpgrade kernel-debug-develUpgrade dtb-apmUpgrade ocfs2-kmp-azureUpgrade kernel-sourceUpgrade kernel-default-baseUpgrade kernel-debugUpgrade kernel-default-optionalUpgrade reiserfs-kmp-defaultUpgrade kernel-64kb-optionalUpgrade kernel-docsUpgrade dtb-exynosUpgrade kernel-defaultUpgrade dlm-kmp-azureUpgrade kernel-default-livepatch-develUpgrade kernel-zfcpdumpUpgrade gfs2-kmp-rtUpgrade kernel-symsUpgrade dtb-xilinxUpgrade dtb-allwinnerUpgrade ocfs2-kmp-rtUpgrade dtb-renesasUpgrade kernel-default-extraUpgrade kernel-default-base-rebuildUpgrade dtb-armUpgrade dtb-nvidiaUpgrade dtb-qcomUpgrade kernel-64kb-develUpgrade ocfs2-kmp-defaultUpgrade kernel-default-vdsoUpgrade kernel-kvmsmall-develUpgrade kernel-rt-develUpgrade cluster-md-kmp-azureUpgrade cluster-md-kmp-rtUpgrade dtb-caviumUpgrade kernel-develUpgrade kernel-devel-rtUpgrade kselftests-kmp-64kbUpgrade kselftests-kmp-defaultUpgrade dtb-amlogicUpgrade dtb-amazonUpgrade kernel-kvmsmall-vdsoUpgrade kernel-macrosUpgrade kernel-64kb-extraUpgrade kselftests-kmp-rtUpgrade kernel-rt_debugUpgrade gfs2-kmp-defaultUpgrade cluster-md-kmp-64kbUpgrade kernel-source-rtUpgrade kernel-debug-vdsoUpgrade dtb-alteraUpgrade ocfs2-kmp-64kbUpgrade kernel-azure-optionalUpgrade dtb-appleUpgrade reiserfs-kmp-64kbUpgrade kernel-kvmsmallUpgrade dlm-kmp-rtUpgrade kernel-rt_debug-vdsoUpgrade kernel-source-azureUpgrade kernel-rt_debug-develUpgrade dtb-broadcomUpgrade dlm-kmp-64kbUpgrade cluster-md-kmp-defaultUpgrade kernel-default-develUpgrade kernel-azure-develUpgrade kernel-default-livepatchUpgrade kernel-obs-buildUpgrade dtb-lgUpgrade kernel-docs-htmlUpgrade kernel-source-vanillaUpgrade kernel-syms-azureUpgrade kernel-rt-vdsoUpgrade kernel-rt-optionalUpgrade kernel-devel-azureUpgrade reiserfs-kmp-rtUpgrade kernel-azure-vdsoUpgrade dtb-sprdUpgrade dtb-socionextUpgrade dtb-marvellUpgrade kernel-syms-rtUpgrade kernel-azure-extraUpgrade kernel-azureUpgrade kernel-64kbUpgrade dlm-kmp-defaultUpgrade dtb-freescaleUpgrade dtb-amdUpgrade kernel-rt-livepatch-develUpgrade kernel-rtUpgrade kselftests-kmp-azureUpgrade kernel-rt-extra | Dec 5, 2025 | Jun 19, 2025 |
| Ubuntu | — | Upgrade linux-image-ibm-classicUpgrade linux-image-6.8.0-1037-oracleUpgrade linux-image-6.8.0-85-generic-64kUpgrade linux-image-ibmUpgrade linux-image-6.8.0-1039-nvidia-64kUpgrade linux-image-6.8.0-84-genericUpgrade linux-image-lowlatency-64k-hwe-24.04Upgrade linux-image-kvmUpgrade linux-image-generic-6.8Upgrade linux-image-nvidia-lowlatencyUpgrade linux-image-6.8.0-1039-aws-64kUpgrade linux-image-raspi-realtimeUpgrade linux-image-realtimeUpgrade linux-image-virtual-6.8Upgrade linux-image-6.11.0-1016-gcpUpgrade linux-image-azure-lts-24.04Upgrade linux-image-azure-fdeUpgrade linux-image-gke-64k-6.8Upgrade linux-image-gcpUpgrade linux-image-azure-nvidiaUpgrade linux-image-azureUpgrade linux-image-oracle-6.8Upgrade linux-image-lowlatency-6.11Upgrade linux-image-6.11.0-1017-oracle-64kUpgrade linux-image-generic-hwe-24.04Upgrade linux-image-6.8.0-1036-gke-64kUpgrade linux-image-6.8.0-1025-azure-nvidiaUpgrade linux-image-aws-64k-lts-24.04Upgrade linux-image-nvidia-64kUpgrade linux-image-azure-fde-lts-24.04Upgrade linux-image-aws-64k-6.8Upgrade linux-image-raspiUpgrade linux-image-6.8.0-1039-nvidia-lowlatency-64kUpgrade linux-image-generic-64k-hwe-24.04Upgrade linux-image-6.11.0-1018-azure-fdeUpgrade linux-image-6.11.0-1015-lowlatency-64kUpgrade linux-image-azure-6.11Upgrade linux-image-6.8.0-84-lowlatencyUpgrade linux-image-6.8.0-1023-gkeopUpgrade linux-image-6.11.0-1016-gcp-64kUpgrade linux-image-6.8.0-1037-ibmUpgrade linux-image-awsUpgrade linux-image-gke-64kUpgrade linux-image-6.11.0-1018-azureUpgrade linux-image-ibm-lts-24.04Upgrade linux-image-nvidia-lowlatency-64kUpgrade linux-image-oracle-64k-lts-24.04Upgrade linux-image-6.11.0-28-generic-64kUpgrade linux-image-6.8.0-1040-gcpUpgrade linux-image-oracle-64kUpgrade linux-image-azure-fde-edgeUpgrade linux-image-6.8.0-84-generic-64kUpgrade linux-image-gkeop-6.8Upgrade linux-image-lowlatency-64k-6.11Upgrade linux-image-ibm-6.8Upgrade linux-image-oracleUpgrade linux-image-6.11.0-1015-lowlatencyUpgrade linux-image-6.11.0-28-genericUpgrade linux-image-6.8.0-1039-awsUpgrade linux-image-oem-22.04bUpgrade linux-image-aws-lts-24.04Upgrade linux-image-generic-64k-6.8Upgrade linux-image-gcp-lts-24.04Upgrade linux-image-azure-fde-6.11Upgrade linux-image-gcp-6.8Upgrade linux-image-generic-hwe-22.04Upgrade linux-image-nvidia-64k-6.8Upgrade linux-image-generic-64k-hwe-22.04Upgrade linux-image-realtime-6.8.1Upgrade linux-image-raspi-6.8Upgrade linux-image-6.11.0-1017-oracleUpgrade linux-image-lowlatency-64k-6.8Upgrade linux-image-virtual-hwe-22.04Upgrade linux-image-oracle-64k-6.8Upgrade linux-image-oem-24.04bUpgrade linux-image-lowlatencyUpgrade linux-image-genericUpgrade linux-image-azure-6.8Upgrade linux-image-6.8.0-1037-oracle-64kUpgrade linux-image-6.11.0-1014-raspiUpgrade linux-image-6.8.0-84-lowlatency-64kUpgrade linux-image-6.8.0-1039-nvidia-lowlatencyUpgrade linux-image-gkeUpgrade linux-image-nvidia-hwe-22.04Upgrade linux-image-6.8.0-1040-gcp-64kUpgrade linux-image-virtualUpgrade linux-image-6.8.0-1038-azureUpgrade linux-image-gcp-64k-lts-24.04Upgrade linux-image-6.8.0-85-genericUpgrade linux-image-oem-22.04aUpgrade linux-image-oem-22.04dUpgrade linux-image-nvidia-6.8Upgrade linux-image-lowlatency-64kUpgrade linux-image-generic-64kUpgrade linux-image-6.11.0-1024-oemUpgrade linux-image-6.11.0-1011-realtimeUpgrade linux-image-6.8.0-1036-azure-fdeUpgrade linux-image-gcp-64k-6.8Upgrade linux-image-6.8.0-1038-azure-fdeUpgrade linux-image-lowlatency-hwe-22.04Upgrade linux-image-gke-6.8Upgrade linux-image-lowlatency-hwe-24.04Upgrade linux-image-oem-22.04Upgrade linux-image-azure-nvidia-lts-24.04Upgrade linux-image-raspi-realtime-6.8Upgrade linux-image-nvidia-lowlatency-6.8Upgrade linux-image-6.8.0-1039-raspiUpgrade linux-image-aws-64kUpgrade linux-image-6.8.0-1036-gkeUpgrade linux-image-lowlatency-64k-hwe-22.04Upgrade linux-image-oem-22.04cUpgrade linux-image-generic-lpaeUpgrade linux-image-lowlatency-6.8Upgrade linux-image-6.8.1-1034-realtimeUpgrade linux-image-nvidia-lowlatency-64k-6.8Upgrade linux-image-realtime-hwe-22.04Upgrade linux-image-nvidia-64k-hwe-22.04Upgrade linux-image-gkeopUpgrade linux-image-gcp-64kUpgrade linux-image-6.11.0-1015-awsUpgrade linux-image-6.8.0-1039-nvidiaUpgrade linux-image-nvidiaUpgrade linux-image-azure-fde-6.8Upgrade linux-image-oracle-lts-24.04Upgrade linux-image-aws-6.8Upgrade linux-image-6.8.0-2031-raspi-realtimeUpgrade linux-image-azure-nvidia-6.8Upgrade linux-image-virtual-hwe-24.04Upgrade linux-image-6.8.0-1036-azure | Jun 26, 2025 | Apr 1, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub