{
    "dataType": "CVE_RECORD",
    "dataVersion": "5.2",
    "cveMetadata": {
        "cveId": "CVE-2025-38246",
        "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "state": "PUBLISHED",
        "assignerShortName": "Linux",
        "dateReserved": "2025-04-16T04:51:23.997Z",
        "datePublished": "2025-07-09T10:42:27.908Z",
        "dateUpdated": "2026-08-05T12:00:40.911Z"
    },
    "containers": {
        "cna": {
            "providerMetadata": {
                "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
                "shortName": "Linux",
                "dateUpdated": "2026-08-05T12:00:40.911Z"
            },
            "descriptions": [
                {
                    "lang": "en",
                    "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbnxt: properly flush XDP redirect lists\n\nWe encountered following crash when testing a XDP_REDIRECT feature\nin production:\n\n[56251.579676] list_add corruption. next->prev should be prev (ffff93120dd40f30), but was ffffb301ef3a6740. (next=ffff93120dd\n40f30).\n[56251.601413] ------------[ cut here ]------------\n[56251.611357] kernel BUG at lib/list_debug.c:29!\n[56251.621082] Oops: invalid opcode: 0000 [#1] PREEMPT SMP NOPTI\n[56251.632073] CPU: 111 UID: 0 PID: 0 Comm: swapper/111 Kdump: loaded Tainted: P           O       6.12.33-cloudflare-2025.6.\n3 #1\n[56251.653155] Tainted: [P]=PROPRIETARY_MODULE, [O]=OOT_MODULE\n[56251.663877] Hardware name: MiTAC GC68B-B8032-G11P6-GPU/S8032GM-HE-CFR, BIOS V7.020.B10-sig 01/22/2025\n[56251.682626] RIP: 0010:__list_add_valid_or_report+0x4b/0xa0\n[56251.693203] Code: 0e 48 c7 c7 68 e7 d9 97 e8 42 16 fe ff 0f 0b 48 8b 52 08 48 39 c2 74 14 48 89 f1 48 c7 c7 90 e7 d9 97 48\n 89 c6 e8 25 16 fe ff <0f> 0b 4c 8b 02 49 39 f0 74 14 48 89 d1 48 c7 c7 e8 e7 d9 97 4c 89\n[56251.725811] RSP: 0018:ffff93120dd40b80 EFLAGS: 00010246\n[56251.736094] RAX: 0000000000000075 RBX: ffffb301e6bba9d8 RCX: 0000000000000000\n[56251.748260] RDX: 0000000000000000 RSI: ffff9149afda0b80 RDI: ffff9149afda0b80\n[56251.760349] RBP: ffff9131e49c8000 R08: 0000000000000000 R09: ffff93120dd40a18\n[56251.772382] R10: ffff9159cf2ce1a8 R11: 0000000000000003 R12: ffff911a80850000\n[56251.784364] R13: ffff93120fbc7000 R14: 0000000000000010 R15: ffff9139e7510e40\n[56251.796278] FS:  0000000000000000(0000) GS:ffff9149afd80000(0000) knlGS:0000000000000000\n[56251.809133] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n[56251.819561] CR2: 00007f5e85e6f300 CR3: 00000038b85e2006 CR4: 0000000000770ef0\n[56251.831365] PKRU: 55555554\n[56251.838653] Call Trace:\n[56251.845560]  <IRQ>\n[56251.851943]  cpu_map_enqueue.cold+0x5/0xa\n[56251.860243]  xdp_do_redirect+0x2d9/0x480\n[56251.868388]  bnxt_rx_xdp+0x1d8/0x4c0 [bnxt_en]\n[56251.877028]  bnxt_rx_pkt+0x5f7/0x19b0 [bnxt_en]\n[56251.885665]  ? cpu_max_write+0x1e/0x100\n[56251.893510]  ? srso_alias_return_thunk+0x5/0xfbef5\n[56251.902276]  __bnxt_poll_work+0x190/0x340 [bnxt_en]\n[56251.911058]  bnxt_poll+0xab/0x1b0 [bnxt_en]\n[56251.919041]  ? srso_alias_return_thunk+0x5/0xfbef5\n[56251.927568]  ? srso_alias_return_thunk+0x5/0xfbef5\n[56251.935958]  ? srso_alias_return_thunk+0x5/0xfbef5\n[56251.944250]  __napi_poll+0x2b/0x160\n[56251.951155]  bpf_trampoline_6442548651+0x79/0x123\n[56251.959262]  __napi_poll+0x5/0x160\n[56251.966037]  net_rx_action+0x3d2/0x880\n[56251.973133]  ? srso_alias_return_thunk+0x5/0xfbef5\n[56251.981265]  ? srso_alias_return_thunk+0x5/0xfbef5\n[56251.989262]  ? __hrtimer_run_queues+0x162/0x2a0\n[56251.996967]  ? srso_alias_return_thunk+0x5/0xfbef5\n[56252.004875]  ? srso_alias_return_thunk+0x5/0xfbef5\n[56252.012673]  ? bnxt_msix+0x62/0x70 [bnxt_en]\n[56252.019903]  handle_softirqs+0xcf/0x270\n[56252.026650]  irq_exit_rcu+0x67/0x90\n[56252.032933]  common_interrupt+0x85/0xa0\n[56252.039498]  </IRQ>\n[56252.044246]  <TASK>\n[56252.048935]  asm_common_interrupt+0x26/0x40\n[56252.055727] RIP: 0010:cpuidle_enter_state+0xb8/0x420\n[56252.063305] Code: dc 01 00 00 e8 f9 79 3b ff e8 64 f7 ff ff 49 89 c5 0f 1f 44 00 00 31 ff e8 a5 32 3a ff 45 84 ff 0f 85 ae\n 01 00 00 fb 45 85 f6 <0f> 88 88 01 00 00 48 8b 04 24 49 63 ce 4c 89 ea 48 6b f1 68 48 29\n[56252.088911] RSP: 0018:ffff93120c97fe98 EFLAGS: 00000202\n[56252.096912] RAX: ffff9149afd80000 RBX: ffff9141d3a72800 RCX: 0000000000000000\n[56252.106844] RDX: 00003329176c6b98 RSI: ffffffe36db3fdc7 RDI: 0000000000000000\n[56252.116733] RBP: 0000000000000002 R08: 0000000000000002 R09: 000000000000004e\n[56252.126652] R10: ffff9149afdb30c4 R11: 071c71c71c71c71c R12: ffffffff985ff860\n[56252.136637] R13: 00003329176c6b98 R14: 0000000000000002 R15: 0000000000000000\n[56252.146667]  ? cpuidle_enter_state+0xab/0x420\n[56252.153909]  cpuidle_enter+0x2d/0x40\n[56252.160360]  do_idle+0x176/0x1c0\n[56252.166456\n---truncated---"
                }
            ],
            "metrics": [
                {
                    "cvssV3_1": {
                        "version": "3.1",
                        "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                        "baseScore": 9.8,
                        "baseSeverity": "CRITICAL"
                    },
                    "scenarios": [
                        {
                            "lang": "en",
                            "value": "AV:N - The bug is triggered entirely by the mix of XDP verdicts produced for received network packets in a single NAPI poll, and those verdicts are decided from attacker-controlled packet headers. A remote unauthenticated attacker sending an interleaved packet stream to an internet-facing bnxt NIC reaches `bnxt_rx_xdp()` with no local access.\nAC:L - In the relevant deployment (a native-mode XDP program on bnxt that uses both XDP_TX and XDP_REDIRECT — the standard L4LB/DDoS-mitigation pattern for this NIC class), the attacker fully controls both sides: they only need one redirected packet followed by one XDP_TX packet within the same 64-packet NAPI batch, which is trivial at line rate. The fix author states the crash reproduces stably by simply returning the two actions randomly.\nPR:N - No authentication or privilege of any kind is needed — the attacker merely sends packets to the interface, and the vulnerable code runs in the NAPI receive path before any socket, credential, or namespace check.\nUI:N - Exploitation requires only inbound traffic processed by the driver's NAPI poll; no victim action is involved.\nS:U - The missed flush corrupts kernel list state and kernel stack memory within the same kernel security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - The stale `bq->flush_node` dangles into a destroyed `net_rx_action()` stack frame, so subsequent list traversal in `__cpu_map_flush`/`__dev_flush` interprets reused kernel stack memory as `struct xdp_bulk_queue` and can feed those contents to `bq_xmit_all()` → `ndo_xdp_xmit`, transmitting kernel memory out a network interface; unflushed xdp_frames also reference page_pool pages that the driver has already recycled.\nI:H - `__list_del_clearprev()` on the stale node writes 8-byte kernel pointers through dangling `prev`/`next` addresses into a kernel stack frame that has since been reused for other execution, corrupting saved registers, locals, and potentially return addresses — a memory-corruption primitive with control-flow implications rather than a mere crash.\nA:H - The defect produced a confirmed production kernel panic — `list_add corruption` → `kernel BUG at lib/list_debug.c:29` → invalid opcode oops in softirq/IRQ context on a 6.12 kernel, taking the machine down and requiring kdump."
                        }
                    ]
                }
            ],
            "affected": [
                {
                    "product": "Linux",
                    "vendor": "Linux",
                    "defaultStatus": "unaffected",
                    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                    "programFiles": [
                        "drivers/net/ethernet/broadcom/bnxt/bnxt.c"
                    ],
                    "versions": [
                        {
                            "version": "a7559bc8c17c3f9a91dcbeefe8642ba757fd09e8",
                            "lessThan": "16254aa985d14dee050564c4a3936f3dc096e1f7",
                            "status": "affected",
                            "versionType": "git"
                        },
                        {
                            "version": "a7559bc8c17c3f9a91dcbeefe8642ba757fd09e8",
                            "lessThan": "c6665b8f0f58082c480ed8627029f44d046ef2c8",
                            "status": "affected",
                            "versionType": "git"
                        },
                        {
                            "version": "a7559bc8c17c3f9a91dcbeefe8642ba757fd09e8",
                            "lessThan": "02bf488d56df9db4f5147280b65d9011e1ab88d2",
                            "status": "affected",
                            "versionType": "git"
                        },
                        {
                            "version": "a7559bc8c17c3f9a91dcbeefe8642ba757fd09e8",
                            "lessThan": "9caca6ac0e26cd20efd490d8b3b2ffb1c7c00f6f",
                            "status": "affected",
                            "versionType": "git"
                        }
                    ]
                },
                {
                    "product": "Linux",
                    "vendor": "Linux",
                    "defaultStatus": "affected",
                    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                    "programFiles": [
                        "drivers/net/ethernet/broadcom/bnxt/bnxt.c"
                    ],
                    "versions": [
                        {
                            "version": "5.19",
                            "status": "affected"
                        },
                        {
                            "version": "0",
                            "lessThan": "5.19",
                            "status": "unaffected",
                            "versionType": "semver"
                        },
                        {
                            "version": "6.6.97",
                            "lessThanOrEqual": "6.6.*",
                            "status": "unaffected",
                            "versionType": "semver"
                        },
                        {
                            "version": "6.12.36",
                            "lessThanOrEqual": "6.12.*",
                            "status": "unaffected",
                            "versionType": "semver"
                        },
                        {
                            "version": "6.15.5",
                            "lessThanOrEqual": "6.15.*",
                            "status": "unaffected",
                            "versionType": "semver"
                        },
                        {
                            "version": "6.16",
                            "lessThanOrEqual": "*",
                            "status": "unaffected",
                            "versionType": "original_commit_for_fix"
                        }
                    ]
                }
            ],
            "cpeApplicability": [
                {
                    "nodes": [
                        {
                            "operator": "OR",
                            "negate": false,
                            "cpeMatch": [
                                {
                                    "vulnerable": true,
                                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                                    "versionStartIncluding": "5.19",
                                    "versionEndExcluding": "6.6.97"
                                },
                                {
                                    "vulnerable": true,
                                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                                    "versionStartIncluding": "5.19",
                                    "versionEndExcluding": "6.12.36"
                                },
                                {
                                    "vulnerable": true,
                                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                                    "versionStartIncluding": "5.19",
                                    "versionEndExcluding": "6.15.5"
                                },
                                {
                                    "vulnerable": true,
                                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                                    "versionStartIncluding": "5.19",
                                    "versionEndExcluding": "6.16"
                                }
                            ]
                        }
                    ]
                }
            ],
            "references": [
                {
                    "url": "https://git.kernel.org/stable/c/16254aa985d14dee050564c4a3936f3dc096e1f7"
                },
                {
                    "url": "https://git.kernel.org/stable/c/c6665b8f0f58082c480ed8627029f44d046ef2c8"
                },
                {
                    "url": "https://git.kernel.org/stable/c/02bf488d56df9db4f5147280b65d9011e1ab88d2"
                },
                {
                    "url": "https://git.kernel.org/stable/c/9caca6ac0e26cd20efd490d8b3b2ffb1c7c00f6f"
                }
            ],
            "title": "bnxt: properly flush XDP redirect lists",
            "x_generator": {
                "engine": "bippy-1.2.0"
            }
        }
    }
}