In the Linux kernel, the following vulnerability has been resolved:
eth: bnxt: fix truesize for mb-xdp-pass case
When mb-xdp is set and return is XDP_PASS, packet is converted from xdp_buff to sk_buff with xdp_update_skb_shared_info() in bnxt_xdp_build_skb(). bnxt_xdp_build_skb() passes incorrect truesize argument to xdp_update_skb_shared_info(). The truesize is calculated as BNXT_RX_PAGE_SIZE * sinfo->nr_frags but the skb_shared_info was wiped by napi_build_skb() before. So it stores sinfo->nr_frags before bnxt_xdp_build_skb() and use it instead of getting skb_shared_info from xdp_get_shared_info_from_buff().
Splat looks like: ------------[ cut here ]------------ WARNING: CPU: 2 PID: 0 at net/core/skbuff.c:6072 skb_try_coalesce+0x504/0x590 Modules linked in: xt_nat xt_tcpudp veth af_packet xt_conntrack nft_chain_nat xt_MASQUERADE nf_conntrack_netlink xfrm_user xt_addrtype nft_coms CPU: 2 UID: 0 PID: 0 Comm: swapper/2 Not tainted 6.14.0-rc2+ #3 RIP: 0010:skb_try_coalesce+0x504/0x590 Code: 4b fd ff ff 49 8b 34 24 40 80 e6 40 0f 84 3d fd ff ff 49 8b 74 24 48 40 f6 c6 01 0f 84 2e fd ff ff 48 8d 4e ff e9 25 fd ff ff <0f> 0b e99 RSP: 0018:ffffb62c4120caa8 EFLAGS: 00010287 RAX: 0000000000000003 RBX: ffffb62c4120cb14 RCX: 0000000000000ec0 RDX: 0000000000001000 RSI: ffffa06e5d7dc000 RDI: 0000000000000003 RBP: ffffa06e5d7ddec0 R08: ffffa06e6120a800 R09: ffffa06e7a119900 R10: 0000000000002310 R11: ffffa06e5d7dcec0 R12: ffffe4360575f740 R13: ffffe43600000000 R14: 0000000000000002 R15: 0000000000000002 FS: 0000000000000000(0000) GS:ffffa0755f700000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f147b76b0f8 CR3: 00000001615d4000 CR4: 00000000007506f0 PKRU: 55555554 Call Trace: <IRQ> ? __warn+0x84/0x130 ? skb_try_coalesce+0x504/0x590 ? report_bug+0x18a/0x1a0 ? handle_bug+0x53/0x90 ? exc_invalid_op+0x14/0x70 ? asm_exc_invalid_op+0x16/0x20 ? skb_try_coalesce+0x504/0x590 inet_frag_reasm_finish+0x11f/0x2e0 ip_defrag+0x37a/0x900 ip_local_deliver+0x51/0x120 ip_sublist_rcv_finish+0x64/0x70 ip_sublist_rcv+0x179/0x210 ip_list_rcv+0xf9/0x130
How to reproduce: <Node A> ip link set $interface1 xdp obj xdp_pass.o ip link set $interface1 mtu 9000 up ip a a 10.0.0.1/24 dev $interface1 <Node B> ip link set $interfac2 mtu 9000 up ip a a 10.0.0.2/24 dev $interface2 ping 10.0.0.1 -s 65000
Following ping.py patch adds xdp-mb-pass case. so ping.py is going to be able to reproduce this issue.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade kernel-64k-debug-coreUpgrade kernel-64k-modules-coreUpgrade kernel-rt-64k-develUpgrade kernel-64k-modulesUpgrade kernel-rt-64kUpgrade kernel-modules-coreUpgrade kernel-64kUpgrade kernel-rt-debugUpgrade kernel-tools-libs-develUpgrade kernel-debug-develUpgrade kernel-rt-develUpgrade kernel-rt-64k-coreUpgrade kernel-debug-uki-virtUpgrade kernel-rt-64k-debugUpgrade kernel-rt-64k-debug-coreUpgrade kernel-debug-modulesUpgrade kernel-rt-coreUpgrade kernel-rt-debug-coreUpgrade kernel-zfcpdump-modules-coreUpgrade kernel-rt-modules-extraUpgrade kernel-rt-64k-debug-modules-extraUpgrade kernel-cross-headersUpgrade rtlaUpgrade kernel-debug-modules-coreUpgrade kernelUpgrade kernel-rt-kvmUpgrade kernel-abi-stablelistsUpgrade python3-perfUpgrade kernel-tools-libsUpgrade kernel-rt-64k-debug-develUpgrade kernel-64k-coreUpgrade kernel-rt-64k-modulesUpgrade kernel-rt-64k-debug-modules-coreUpgrade kernel-debug-devel-matchedUpgrade kernel-headersUpgrade kernel-rt-64k-modules-coreUpgrade kernel-rt-64k-debug-modulesUpgrade kernel-uki-virt-addonsUpgrade kernel-toolsUpgrade kernel-rt-debug-develUpgrade kernel-64k-develUpgrade kernel-rt-modules-coreUpgrade kernel-64k-debug-modulesUpgrade kernel-zfcpdump-modules-extraUpgrade kernel-rt-debug-modules-coreUpgrade kernel-64k-devel-matchedUpgrade kernel-64k-debug-modules-coreUpgrade kernel-develUpgrade kernel-zfcpdump-coreUpgrade perfUpgrade kernel-debug-coreUpgrade kernel-docUpgrade rvUpgrade kernel-64k-debugUpgrade kernel-uki-virtUpgrade kernel-64k-modules-extraUpgrade kernel-64k-debug-develUpgrade kernel-devel-matchedUpgrade kernel-64k-debug-devel-matchedUpgrade kernel-rt-debug-modules-extraUpgrade kernel-64k-debug-modules-extraUpgrade kernel-debugUpgrade kernel-modules-extraUpgrade kernel-rt-64k-modules-extraUpgrade kernel-zfcpdump-devel-matchedUpgrade kernel-zfcpdump-develUpgrade libperfUpgrade kernel-modulesUpgrade kernel-rtUpgrade kernel-rt-debug-modulesUpgrade kernel-zfcpdump-modulesUpgrade kernel-coreUpgrade kernel-rt-debug-kvmUpgrade kernel-zfcpdumpUpgrade kernel-debug-modules-extraUpgrade kernel-rt-modules | Jul 4, 2025 | Apr 1, 2025 |
| Debian | — | Upgrade linuxNo solution exists | May 15, 2025 | Apr 1, 2025 |
| Oracle_linux | — | Upgrade kernel | Jun 30, 2025 | Apr 1, 2025 |
| Redhat_linux | — | Upgrade kernelUpgrade kernel-rtNo solution exists | Jun 17, 2025 | Apr 1, 2025 |
| Rocky_linux | — | Upgrade kernel-rt-modulesUpgrade kernel-rt-modules-extraUpgrade kernel-zfcpdump-modulesUpgrade kernel-rt-debug-modules-coreUpgrade kernel-debug-modulesUpgrade kernel-rt-debug-coreUpgrade kernel-zfcpdump-devel-matchedUpgrade kernel-uki-virt-addonsUpgrade kernel-devel-matchedUpgrade kernel-rt-debug-debuginfoUpgrade kernel-toolsUpgrade kernel-rt-modules-coreUpgrade kernel-rtUpgrade kernel-debug-devel-matchedUpgrade kernel-debug-modules-extraUpgrade kernel-debug-debuginfoUpgrade rvUpgrade kernel-tools-libs-develUpgrade kernel-zfcpdump-coreUpgrade kernel-rt-kvmUpgrade libperf-debuginfoUpgrade kernel-rt-debuginfoUpgrade kernel-zfcpdump-modules-coreUpgrade kernel-coreUpgrade python3-perf-debuginfoUpgrade kernel-headersUpgrade kernel-debug-uki-virtUpgrade kernel-rt-debug-modules-extraUpgrade libperfUpgrade kernel-zfcpdump-debuginfoUpgrade kernel-rt-develUpgrade kernel-rt-debugUpgrade kernel-zfcpdump-modules-extraUpgrade kernel-zfcpdumpUpgrade kernel-tools-debuginfoUpgrade kernel-develUpgrade kernel-rt-debug-develUpgrade kernel-rt-coreUpgrade kernel-uki-virtUpgrade kernel-debug-coreUpgrade kernel-zfcpdump-develUpgrade kernel-rt-debug-kvmUpgrade kernel-debuginfoUpgrade kernel-tools-libsUpgrade kernel-modules-extraUpgrade kernel-rt-debug-modulesUpgrade kernel-cross-headersUpgrade kernel-debug-develUpgrade kernelUpgrade kernel-modulesUpgrade perf-debuginfoUpgrade kernel-debug-modules-coreUpgrade kernel-modules-coreUpgrade python3-perfUpgrade kernel-debugUpgrade rtlaUpgrade perf | Oct 6, 2025 | Oct 4, 2025 |
| Suse | — | Upgrade kernel-syms-rtUpgrade dtb-marvellUpgrade kernel-64kbUpgrade kernel-azureUpgrade dtb-socionextUpgrade dtb-amdUpgrade kernel-azure-extraUpgrade dtb-sprdUpgrade ocfs2-kmp-64kbUpgrade kernel-rt_debug-develUpgrade kselftests-kmp-rtUpgrade dlm-kmp-defaultUpgrade kselftests-kmp-azureUpgrade dtb-freescaleUpgrade kernel-rt-livepatch-develUpgrade cluster-md-kmp-64kbUpgrade kernel-rt-extraUpgrade kernel-azure-optionalUpgrade gfs2-kmp-defaultUpgrade kernel-64kb-extraUpgrade kernel-default-livepatchUpgrade kernel-macrosUpgrade dtb-amlogicUpgrade kernel-default-develUpgrade kernel-rtUpgrade kernel-debug-vdsoUpgrade kernel-rt_debugUpgrade kernel-kvmsmall-vdsoUpgrade reiserfs-kmp-64kbUpgrade dlm-kmp-rtUpgrade dtb-amazonUpgrade kernel-source-rtUpgrade kernel-syms-azureUpgrade reiserfs-kmp-rtUpgrade kernel-azure-vdsoUpgrade dtb-alteraUpgrade kernel-azure-develUpgrade kernel-docs-htmlUpgrade kernel-source-azureUpgrade kernel-source-vanillaUpgrade dtb-lgUpgrade kernel-rt_debug-vdsoUpgrade kernel-kvmsmallUpgrade dlm-kmp-64kbUpgrade dtb-broadcomUpgrade dtb-appleUpgrade kernel-obs-buildUpgrade cluster-md-kmp-defaultUpgrade kernel-rt-vdsoUpgrade kernel-devel-azureUpgrade kernel-rt-optionalUpgrade dtb-xilinxUpgrade dtb-caviumUpgrade cluster-md-kmp-rtUpgrade kernel-default-base-rebuildUpgrade gfs2-kmp-rtUpgrade cluster-md-kmp-azureUpgrade kselftests-kmp-64kbUpgrade kernel-devel-rtUpgrade kselftests-kmp-defaultUpgrade dtb-apmUpgrade dtb-rockchipUpgrade kernel-debug-develUpgrade dtb-hisiliconUpgrade dlm-kmp-azureUpgrade kernel-obs-qaUpgrade kernel-default-vdsoUpgrade ocfs2-kmp-defaultUpgrade kernel-rt-develUpgrade kernel-64kb-develUpgrade gfs2-kmp-azureUpgrade dtb-qcomUpgrade ocfs2-kmp-azureUpgrade kernel-kvmsmall-develUpgrade dtb-nvidiaUpgrade dtb-mediatekUpgrade kernel-develUpgrade kernel-default-baseUpgrade kernel-default-livepatch-develUpgrade reiserfs-kmp-defaultUpgrade kernel-defaultUpgrade kernel-64kb-optionalUpgrade dtb-exynosUpgrade kernel-zfcpdumpUpgrade kernel-docsUpgrade kernel-debugUpgrade gfs2-kmp-64kbUpgrade dtb-renesasUpgrade dtb-armUpgrade reiserfs-kmp-azureUpgrade ocfs2-kmp-rtUpgrade kernel-sourceUpgrade kernel-default-optionalUpgrade dtb-allwinnerUpgrade kernel-symsUpgrade kernel-default-extra | Dec 5, 2025 | Jun 19, 2025 |
| Ubuntu | — | Upgrade linux-image-raspi-6.8Upgrade linux-image-6.8.0-1040-gcp-64kUpgrade linux-image-azure-fde-6.8Upgrade linux-image-gkeUpgrade linux-image-6.8.0-1039-nvidiaUpgrade linux-image-aws-6.8Upgrade linux-image-nvidiaUpgrade linux-image-generic-lpaeUpgrade linux-image-6.8.0-1038-azure-fdeUpgrade linux-image-6.11.0-1015-awsUpgrade linux-image-6.11.0-1024-oemUpgrade linux-image-6.8.0-2031-raspi-realtimeUpgrade linux-image-oem-22.04dUpgrade linux-image-oracle-lts-24.04Upgrade linux-image-6.11.0-1011-realtimeUpgrade linux-image-generic-64kUpgrade linux-image-realtime-6.8.1Upgrade linux-image-lowlatency-64kUpgrade linux-image-gcp-64k-lts-24.04Upgrade linux-image-lowlatency-hwe-24.04Upgrade linux-image-oem-22.04Upgrade linux-image-lowlatency-64k-hwe-22.04Upgrade linux-image-6.8.0-1036-azure-fdeUpgrade linux-image-6.8.0-1038-azureUpgrade linux-image-6.8.0-1039-nvidia-lowlatencyUpgrade linux-image-6.8.0-1039-raspiUpgrade linux-image-gkeopUpgrade linux-image-lowlatency-6.8Upgrade linux-image-gcp-64k-6.8Upgrade linux-image-nvidia-6.8Upgrade linux-image-virtualUpgrade linux-image-6.11.0-1014-raspiUpgrade linux-image-nvidia-hwe-22.04Upgrade linux-image-6.8.0-84-lowlatency-64kUpgrade linux-image-nvidia-64k-hwe-22.04Upgrade linux-image-6.11.0-1017-oracleUpgrade linux-image-generic-64k-hwe-22.04Upgrade linux-image-6.8.1-1034-realtimeUpgrade linux-image-lowlatencyUpgrade linux-image-oem-22.04aUpgrade linux-image-6.8.0-85-genericUpgrade linux-image-gcp-64kUpgrade linux-image-oem-22.04cUpgrade linux-image-oem-24.04bUpgrade linux-image-oracle-64k-6.8Upgrade linux-image-realtime-hwe-22.04Upgrade linux-image-virtual-hwe-22.04Upgrade linux-image-lowlatency-hwe-22.04Upgrade linux-image-nvidia-lowlatency-64k-6.8Upgrade linux-image-raspi-realtime-6.8Upgrade linux-image-6.8.0-1037-oracle-64kUpgrade linux-image-aws-64kUpgrade linux-image-virtual-hwe-24.04Upgrade linux-image-gke-6.8Upgrade linux-image-azure-nvidia-6.8Upgrade linux-image-nvidia-lowlatency-6.8Upgrade linux-image-6.8.0-1036-azureUpgrade linux-image-6.8.0-1036-gkeUpgrade linux-image-azure-6.8Upgrade linux-image-lowlatency-64k-6.8Upgrade linux-image-azure-nvidia-lts-24.04Upgrade linux-image-genericUpgrade linux-image-6.8.0-1039-nvidia-lowlatency-64kUpgrade linux-image-ibmUpgrade linux-image-gke-64kUpgrade linux-image-lowlatency-6.11Upgrade linux-image-6.8.0-1023-gkeopUpgrade linux-image-6.11.0-1015-lowlatencyUpgrade linux-image-raspiUpgrade linux-image-6.8.0-84-lowlatencyUpgrade linux-image-6.8.0-84-genericUpgrade linux-image-6.8.0-1039-aws-64kUpgrade linux-image-azure-fde-lts-24.04Upgrade linux-image-oracle-64k-lts-24.04Upgrade linux-image-oracleUpgrade linux-image-aws-64k-6.8Upgrade linux-image-generic-64k-6.8Upgrade linux-image-nvidia-lowlatency-64kUpgrade linux-image-6.8.0-85-generic-64kUpgrade linux-image-6.8.0-1037-oracleUpgrade linux-image-ibm-classicUpgrade linux-image-lowlatency-64k-hwe-24.04Upgrade linux-image-aws-lts-24.04Upgrade linux-image-6.11.0-1015-lowlatency-64kUpgrade linux-image-kvmUpgrade linux-image-azure-6.11Upgrade linux-image-gke-64k-6.8Upgrade linux-image-azure-fdeUpgrade linux-image-gcp-lts-24.04Upgrade linux-image-azure-lts-24.04Upgrade linux-image-gcpUpgrade linux-image-6.11.0-1018-azure-fdeUpgrade linux-image-nvidia-64k-6.8Upgrade linux-image-virtual-6.8Upgrade linux-image-6.11.0-1017-oracle-64kUpgrade linux-image-azureUpgrade linux-image-realtimeUpgrade linux-image-oracle-6.8Upgrade linux-image-nvidia-lowlatencyUpgrade linux-image-generic-hwe-22.04Upgrade linux-image-6.11.0-1016-gcpUpgrade linux-image-6.8.0-84-generic-64kUpgrade linux-image-6.11.0-28-genericUpgrade linux-image-generic-64k-hwe-24.04Upgrade linux-image-6.8.0-1039-nvidia-64kUpgrade linux-image-generic-6.8Upgrade linux-image-raspi-realtimeUpgrade linux-image-6.8.0-1036-gke-64kUpgrade linux-image-ibm-6.8Upgrade linux-image-azure-fde-6.11Upgrade linux-image-awsUpgrade linux-image-ibm-lts-24.04Upgrade linux-image-gcp-6.8Upgrade linux-image-azure-nvidiaUpgrade linux-image-azure-fde-edgeUpgrade linux-image-6.11.0-1018-azureUpgrade linux-image-6.11.0-1016-gcp-64kUpgrade linux-image-generic-hwe-24.04Upgrade linux-image-aws-64k-lts-24.04Upgrade linux-image-6.8.0-1040-gcpUpgrade linux-image-lowlatency-64k-6.11Upgrade linux-image-gkeop-6.8Upgrade linux-image-6.8.0-1039-awsUpgrade linux-image-6.8.0-1037-ibmUpgrade linux-image-6.8.0-1025-azure-nvidiaUpgrade linux-image-6.11.0-28-generic-64kUpgrade linux-image-oracle-64kUpgrade linux-image-nvidia-64kUpgrade linux-image-oem-22.04b | Jun 26, 2025 | Apr 1, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub