{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2025-22108", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-12-29T08:45:45.820Z", "datePublished": "2025-04-16T14:12:55.737Z", "dateUpdated": "2026-08-05T11:56:48.530Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:56:48.530Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbnxt_en: Mask the bd_cnt field in the TX BD properly\n\nThe bd_cnt field in the TX BD specifies the total number of BDs for\nthe TX packet. The bd_cnt field has 5 bits and the maximum number\nsupported is 32 with the value 0.\n\nCONFIG_MAX_SKB_FRAGS can be modified and the total number of SKB\nfragments can approach or exceed the maximum supported by the chip.\nAdd a macro to properly mask the bd_cnt field so that the value 32\nwill be properly masked and set to 0 in the bd_cnd field.\n\nWithout this patch, the out-of-range bd_cnt value will corrupt the\nTX BD and may cause TX timeout.\n\nThe next patch will check for values exceeding 32." } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H", "baseScore": 8.6, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:N - bnxt_en is a datacenter NIC typically deployed on routing/bridging/VM hosts, where an unauthenticated remote peer's burst of segments is coalesced by GRO into an skb with 30+ fragments and forwarded out the bnxt port, reaching bnxt_start_xmit() with no linearization because the driver advertises NETIF_F_SG.\nAC:L - On a kernel built with CONFIG_MAX_SKB_FRAGS >= 30 (the configuration in which the flaw exists, used in BIG TCP deployments), the attacker reliably drives the fragment count simply by sending a sustained burst, with no race or memory-layout condition to win.\nPR:N - In the forwarding scenario the trigger is ordinary unauthenticated network traffic transiting the host; no credentials or local account are needed, and the locally-reachable variant requires only an unprivileged socket.\nUI:N - Transmission happens automatically as part of normal packet forwarding or socket I/O; no victim action is required.\nS:U - The malformed descriptor, ring desynchronization, and subsequent device reset are all confined to the host kernel and its NIC, within a single security authority.\nC:L - The mis-parsed bd_cnt makes the chip consume descriptors beyond those the driver posted, so stale ring entries pointing at already-unmapped buffers can be DMA'd and emitted onto the wire, exposing a bounded amount of freed kernel buffer content to the attacker's network.\nI:L - The corrupted bd_cnt and length-hint bits cause mis-framed and truncated frames to be placed on the wire, and the resulting completion desync leads to dma_unmap calls with mismatched address/length against buffers the NIC still owns.\nA:H - The commit states the out-of-range bd_cnt corrupts the TX BD and causes TX timeout; the desynchronized completion path hits WARN_ON_ONCE(1) in bnxt_sched_reset_txr() and queues BNXT_RESET_TASK_SP_EVENT, forcing a full device reset and repeatable loss of network connectivity (an immediate panic on panic_on_warn systems)." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/net/ethernet/broadcom/bnxt/bnxt.c", "drivers/net/ethernet/broadcom/bnxt/bnxt.h", "drivers/net/ethernet/broadcom/bnxt/bnxt_xdp.c" ], "versions": [ { "version": "3948b05950fdd64002a5f182c65ba5cf2d53cf71", "lessThan": "f60b41b815826f15c4d0323f923f398c423178d0", "status": "affected", "versionType": "git" }, { "version": "3948b05950fdd64002a5f182c65ba5cf2d53cf71", "lessThan": "107b25db61122d8f990987895c2912927b8b6e3f", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/net/ethernet/broadcom/bnxt/bnxt.c", "drivers/net/ethernet/broadcom/bnxt/bnxt.h", "drivers/net/ethernet/broadcom/bnxt/bnxt_xdp.c" ], "versions": [ { "version": "6.4", "status": "affected" }, { "version": "0", "lessThan": "6.4", "status": "unaffected", "versionType": "semver" }, { "version": "6.14.2", "lessThanOrEqual": "6.14.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.15", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.4", "versionEndExcluding": "6.14.2" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.4", "versionEndExcluding": "6.15" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/f60b41b815826f15c4d0323f923f398c423178d0" }, { "url": "https://git.kernel.org/stable/c/107b25db61122d8f990987895c2912927b8b6e3f" } ], "title": "bnxt_en: Mask the bd_cnt field in the TX BD properly", "x_generator": { "engine": "bippy-1.2.0" } } } }