Memory Corruption Vulnerability in Linux Kernel Affecting bnxt_en Driver

CVE-2025-39810

What is CVE-2025-39810?

The bnxt_en driver in the Linux kernel features a memory corruption vulnerability that arises during firmware resource changes when the device is taken offline. The function bnxt_set_dflt_rings() inadequately assumes a limited number of traffic classes (TC), leading to an improper calculation of transmission ring sizes. When firmware flags initiate a reinitialization sequence while more than one TC exists, it erroneously sizes the transmission rings, potentially causing memory corruption and instability. This vulnerability has been resolved by implementing checks that scale the TX rings according to the actual number of TCs and by developing helper functions for accurate ring size determination.

References