CVE-2025-38439

In the Linux kernel, the following vulnerability has been resolved: bnxten: Set DMA unmap len correctly for XDPREDIRECT When transmitting an XDPREDIRECT packet, call dmaunmaplenset with the proper length instead of 0. This bug triggers this warning on a system with IOMMU enabled: WARNING: CPU: 36...

CVE-2025-38186 bnxt_en: Fix double invocation of bnxt_ulp_stop()/bnxt_ulp_start()

In the Linux kernel, the following vulnerability has been resolved: bnxten: Fix double invocation of bnxtulpstop/bnxtulpstart Before the commit under the Fixes tag below, bnxtulpstop and bnxtulpstart were always invoked in pairs. After that commit, the new bnxtulprestart can be invoked after...

CVE-2025-38186

CVE-2025-38186 (Linux kernel, bnxt_en/RoCE driver) : The issue arises from a double invocation path where bnxt_ulp_stop() and bnxt_ulp_start() can be invoked in sequence after bnxt_ulp_restart(), causing the RoCE driver’s aux driver suspend() to run twice and potentially dereference a NULL pointe...

CVE-2025-38186 bnxt_en: Fix double invocation of bnxt_ulp_stop()/bnxt_ulp_start()

In the Linux kernel, the following vulnerability has been resolved: bnxten: Fix double invocation of bnxtulpstop/bnxtulpstart Before the commit under the Fixes tag below, bnxtulpstop and bnxtulpstart were always invoked in pairs. After that commit, the new bnxtulprestart can be invoked after...

Astra Linux – Vulnerability in Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: bnxten: Fixed error handling in bnxtinitchip. The WARNON function is triggered in flushwork if bnxtinitchip fails because we call cancelworksync on dim work that has not been initialized. WARNING: CPU: 37 PID: 5223 at...

CVE-2025-37911 bnxt_en: Fix out-of-bound memcpy() during ethtool -w

In the Linux kernel, the following vulnerability has been resolved: bnxten: Fix out-of-bound memcpy during ethtool -w When retrieving the FW coredump using ethtool, it can sometimes cause memory corruption: BUG: KFENCE: memory corruption in bnxtgetcoredump+0x3ef/0x670 bnxten Corrupted memory at...

CVE-2025-37895

The CVE affects the Linux kernel BNXT Ethernet driver (bnxt_en). The root cause is in bnxt_init_chip() where a failure path triggers cancel_work_sync() on uninitialized dim work because BNXT_STATE_NAPI_DISABLED is not set during bnxt_open(). The fix sets BNXT_STATE_NAPI_DISABLED during initializa...

CVE-2025-37895 bnxt_en: Fix error handling path in bnxt_init_chip()

In the Linux kernel, the following vulnerability has been resolved: bnxten: Fix error handling path in bnxtinitchip WARNON is triggered in flushwork if bnxtinitchip fails because we call cancelworksync on dim work that has not been initialized. WARNING: CPU: 37 PID: 5223 at kernel/workqueue.c:420...

Linux kernel 安全漏洞

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A security vulnerability exists in Linux kernel, which stems from a memory copy out of bounds in the bnxten module when ethtool fetches a firmware dump, which could lead to...

CVE-2023-53134

In the Linux kernel, the following vulnerability has been resolved: bnxten: Avoid order-5 memory allocation for TPA data The driver needs to keep track of all the possible concurrent TPA GRO/LRO completions on the aggregation ring. On P5 chips, the maximum number of concurrent TPA is 256 and the...

CVE-2023-53134 bnxt_en: Avoid order-5 memory allocation for TPA data

In the Linux kernel, the following vulnerability has been resolved: bnxten: Avoid order-5 memory allocation for TPA data The driver needs to keep track of all the possible concurrent TPA GRO/LRO completions on the aggregation ring. On P5 chips, the maximum number of concurrent TPA is 256 and the...

CVE-2022-49869

CVE-2022-49869 (bnxt_en): In the Linux kernel bnxt_hwrm_set_coal() may crash during error recovery because rtnl_lock isn’t held for the entire sequence, allowing freed datastructures. The fix uses BNXT_STATE_OPEN rather than netif_running() to ensure the device is fully operational before reconfi...

CVE-2022-49869 bnxt_en: Fix possible crash in bnxt_hwrm_set_coal()

In the Linux kernel, the following vulnerability has been resolved: bnxten: Fix possible crash in bnxthwrmsetcoal During the error recovery sequence, the rtnllock is not held for the entire duration and some datastructures may be freed during the sequence. Check for the BNXTSTATEOPEN flag instead...

CVE-2022-49869 bnxt_en: Fix possible crash in bnxt_hwrm_set_coal()

In the Linux kernel, the following vulnerability has been resolved: bnxten: Fix possible crash in bnxthwrmsetcoal During the error recovery sequence, the rtnllock is not held for the entire duration and some datastructures may be freed during the sequence. Check for the BNXTSTATEOPEN flag instead...

SUSE CVE-2025-22108

In the Linux kernel, the following vulnerability has been resolved: bnxten: Mask the bdcnt field in the TX BD properly The bdcnt field in the TX BD specifies the total number of BDs for the TX packet. The bdcnt field has 5 bits and the maximum number supported is 32 with the value 0...

The vulnerability of the bnxt_en component in the Linux operating system’s kernel allows a hacker to trigger a service failure.

The vulnerability of the bnxten component in the Linux operating system’s kernel is related to resource management errors. Exploiting this vulnerability can allow an attacker to cause service failures...

SUSE CVE-2024-56656

In the Linux kernel, the following vulnerability has been resolved: bnxten: Fix aggregation ID mask to prevent oops on 5760X chips The 5760X P7 chip's HW GRO/LRO interface is very similar to that of the previous generation 5750X or P5. However, the aggregation ID fields in the completion structur...

CVE-2024-53209

In the Linux kernel, the following vulnerability has been resolved: bnxten: Fix receive ring space parameters when XDP is active The MTU setting at the time an XDP multi-buffer is attached determines whether the aggregation ring will be used and the rxskbfunc handler. This is done in...

SUSE CVE-2024-53209

In the Linux kernel, the following vulnerability has been resolved: bnxten: Fix receive ring space parameters when XDP is active The MTU setting at the time an XDP multi-buffer is attached determines whether the aggregation ring will be used and the rxskbfunc handler. This is done in...

CVE-2024-56656 bnxt_en: Fix aggregation ID mask to prevent oops on 5760X chips

In the Linux kernel, the following vulnerability has been resolved: bnxten: Fix aggregation ID mask to prevent oops on 5760X chips The 5760X P7 chip's HW GRO/LRO interface is very similar to that of the previous generation 5750X or P5. However, the aggregation ID fields in the completion structur...