CVE-2025-39810: bnxt_en: Fix memory corruption when FW resources change during ifdown

Severity: high (CVSS 7.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-09-16 · updated 2026-10-30
Weakness: CWE-787

Description

In the Linux kernel, the following vulnerability has been resolved: bnxt_en: Fix memory corruption when FW resources change during ifdown bnxt_set_dflt_rings() assumes that it is always called before any TC has been created. So it doesn't take bp->num_tc into account and assumes that it is always 0 or 1. In the FW resource or capability change scenario, the FW will return flags in bnxt_hwrm_if_change() that will cause the driver to reinitialize and call bnxt_cancel_reservations(). This will lead to bnxt_init_dflt_ring_mode() calling bnxt_set_dflt_rings() and bp->num_tc may be greater than 1. This will cause bp->tx_ring[] to be sized too small and cause memory corruption in bnxt_alloc_cp_rings(). Fix it by properly scaling the TX rings by bp->num_tc in the code paths mentioned above. Add 2 helper functions to determine bp->tx_nr_rings and bp->tx_nr_rings_per_tc.

Affected products

Linux kernel: from 5.4 before 6.12.45; from 6.13 before 6.16.5; 6.17-rc1, 6.17-rc2, 6.17-rc3 — fixed in 6.12.45, 6.16.5
Linux: 5.4 — fixed in 6.17

How to fix

Upgrade to a fixed version: Linux kernel 6.12.45, 6.16.5; Linux 6.17. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2025-39810 or the next vulnerability affects your stack