In the Linux kernel, the following vulnerability has been resolved:
bnxt_en: Fix memory corruption when FW resources change during ifdown
bnxt_set_dflt_rings() assumes that it is always called before any TC has
been created. So it doesn't take bp->num_tc into account and assumes
that it is always 0 or 1.
In the FW resource or capability change scenario, the FW will return
flags in bnxt_hwrm_if_change() that will cause the driver to
reinitialize and call bnxt_cancel_reservations(). This will lead to
bnxt_init_dflt_ring_mode() calling bnxt_set_dflt_rings() and bp->num_tc
may be greater than 1. This will cause bp->tx_ring[] to be sized too
small and cause memory corruption in bnxt_alloc_cp_rings().
Fix it by properly scaling the TX rings by bp->num_tc in the code
paths mentioned above. Add 2 helper functions to determine
bp->tx_nr_rings and bp->tx_nr_rings_per_tc.
References
Configurations
Configuration 1 (hide)
|
History
02 Dec 2025, 18:46
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 7.8 |
| First Time |
Linux linux Kernel
Linux |
|
| CPE | cpe:2.3:o:linux:linux_kernel:6.17:rc2:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:6.17:rc3:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:6.17:rc1:*:*:*:*:*:* |
|
| References | () https://git.kernel.org/stable/c/2747328ba2714f1a7454208dbbc1dc0631990b4a - Patch | |
| References | () https://git.kernel.org/stable/c/9ab6a9950f152e094395d2e3967f889857daa185 - Patch | |
| References | () https://git.kernel.org/stable/c/d00e98977ef519280b075d783653e2c492fffbb6 - Patch | |
| CWE | CWE-787 |
Information
Published : 2025-09-16 13:15
Updated : 2025-12-02 18:46
NVD link : CVE-2025-39810
Mitre link : CVE-2025-39810
CVE.ORG link : CVE-2025-39810
JSON object : View
Products Affected
linux
- linux_kernel
CWE
CWE-787
Out-of-bounds Write