CVE-2025-39810

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-39810
In the Linux kernel, the following vulnerability has been resolved: bnxt_en: Fix memory corruption when FW resources change during ifdown bnxt_set_dflt_rings() assumes that it is always called before any TC has been created. So it doesn't take bp->num_tc into account and assumes that it is always 0 or 1. In the FW resource or capability change scenario, the FW will return flags in bnxt_hwrm_if_change() that will cause the driver to reinitialize and call bnxt_cancel_reservations(). This will lead to bnxt_init_dflt_ring_mode() calling bnxt_set_dflt_rings() and bp->num_tc may be greater than 1. This will cause bp->tx_ring[] to be sized too small and cause memory corruption in bnxt_alloc_cp_rings(). Fix it by properly scaling the TX rings by bp->num_tc in the code paths mentioned above. Add 2 helper functions to determine bp->tx_nr_rings and bp->tx_nr_rings_per_tc.

7.8 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://git.kernel.org/stable/c/2747328ba2714f1a7454208dbbc1dc0631990b4a Patch
https://git.kernel.org/stable/c/9ab6a9950f152e094395d2e3967f889857daa185 Patch
https://git.kernel.org/stable/c/c0082a8947cf1a543013346d10c1857f0c57db83
https://git.kernel.org/stable/c/d00e98977ef519280b075d783653e2c492fffbb6 Patch
https://git.kernel.org/stable/c/dc797a4bbbcac6d19e6e2508e4df685755cd94a5
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.17:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.17:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.17:rc3:*:*:*:*:*:*
History

30 Oct 2026, 13:18

Type Values Removed Values Added
References
  • () https://git.kernel.org/stable/c/c0082a8947cf1a543013346d10c1857f0c57db83 -

21 Oct 2026, 13:18

Type Values Removed Values Added
References
  • () https://git.kernel.org/stable/c/dc797a4bbbcac6d19e6e2508e4df685755cd94a5 -

19 Oct 2026, 21:10

Type Values Removed Values Added
Summary
  • (es) En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta: bnxt_en: Corrige la corrupción de memoria cuando los recursos del FW cambian durante el ifdown bnxt_set_dflt_rings() asume que siempre se llama antes de que se haya creado cualquier TC. Por lo tanto, no tiene en cuenta bp->num_tc y asume que siempre es 0 o 1. En el escenario de cambio de recursos o capacidades del FW, el FW devolverá flags en bnxt_hwrm_if_change() que harán que el controlador se reinicialice y llame a bnxt_cancel_reservations(). Esto llevará a que bnxt_init_dflt_ring_mode() llame a bnxt_set_dflt_rings() y bp->num_tc puede ser mayor que 1. Esto hará que bp->tx_ring[] tenga un tamaño demasiado pequeño y cause corrupción de memoria en bnxt_alloc_cp_rings(). Se corrige escalando correctamente los anillos TX por bp->num_tc en las rutas de código mencionadas anteriormente. Se añaden 2 funciones auxiliares para determinar bp->tx_nr_rings y bp->tx_nr_rings_per_tc.
Information

Published : 2025-09-16 13:15

Updated : 2026-10-30 13:18

NVD link : CVE-2025-39810

Mitre link : CVE-2025-39810

CVE.ORG link : CVE-2025-39810

JSON object : View

Products Affected

linux

  • linux_kernel
CWE
CWE-787

Out-of-bounds Write