{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2025-22108","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","state":"PUBLISHED","assignerShortName":"Linux","dateReserved":"2024-12-29T08:45:45.820Z","datePublished":"2025-04-16T14:12:55.737Z","dateUpdated":"2026-09-07T15:44:43.232Z"},"containers":{"cna":{"providerMetadata":{"orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux","dateUpdated":"2026-09-07T15:44:43.232Z"},"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nbnxt_en: Mask the bd_cnt field in the TX BD properly\n\nThe bd_cnt field in the TX BD specifies the total number of BDs for\nthe TX packet.  The bd_cnt field has 5 bits and the maximum number\nsupported is 32 with the value 0.\n\nCONFIG_MAX_SKB_FRAGS can be modified and the total number of SKB\nfragments can approach or exceed the maximum supported by the chip.\nAdd a macro to properly mask the bd_cnt field so that the value 32\nwill be properly masked and set to 0 in the bd_cnd field.\n\nWithout this patch, the out-of-range bd_cnt value will corrupt the\nTX BD and may cause TX timeout.\n\nThe next patch will check for values exceeding 32."}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H","baseScore":8.6,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:N - bnxt_en is a datacenter NIC typically deployed on routing/bridging/VM hosts, where an unauthenticated remote peer's burst of segments is coalesced by GRO into an skb with 30+ fragments and forwarded out the bnxt port, reaching bnxt_start_xmit() with no linearization because the driver advertises NETIF_F_SG.\nAC:L - On a kernel built with CONFIG_MAX_SKB_FRAGS >= 30 (the configuration in which the flaw exists, used in BIG TCP deployments), the attacker reliably drives the fragment count simply by sending a sustained burst, with no race or memory-layout condition to win.\nPR:N - In the forwarding scenario the trigger is ordinary unauthenticated network traffic transiting the host; no credentials or local account are needed, and the locally-reachable variant requires only an unprivileged socket.\nUI:N - Transmission happens automatically as part of normal packet forwarding or socket I/O; no victim action is required.\nS:U - The malformed descriptor, ring desynchronization, and subsequent device reset are all confined to the host kernel and its NIC, within a single security authority.\nC:L - The mis-parsed bd_cnt makes the chip consume descriptors beyond those the driver posted, so stale ring entries pointing at already-unmapped buffers can be DMA'd and emitted onto the wire, exposing a bounded amount of freed kernel buffer content to the attacker's network.\nI:L - The corrupted bd_cnt and length-hint bits cause mis-framed and truncated frames to be placed on the wire, and the resulting completion desync leads to dma_unmap calls with mismatched address/length against buffers the NIC still owns.\nA:H - The commit states the out-of-range bd_cnt corrupts the TX BD and causes TX timeout; the desynchronized completion path hits WARN_ON_ONCE(1) in bnxt_sched_reset_txr() and queues BNXT_RESET_TASK_SP_EVENT, forcing a full device reset and repeatable loss of network connectivity (an immediate panic on panic_on_warn systems)."}]}],"affected":[{"product":"Linux","vendor":"Linux","defaultStatus":"unaffected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/net/ethernet/broadcom/bnxt/bnxt.c","drivers/net/ethernet/broadcom/bnxt/bnxt.h","drivers/net/ethernet/broadcom/bnxt/bnxt_xdp.c"],"versions":[{"version":"3948b05950fdd64002a5f182c65ba5cf2d53cf71","lessThan":"9ee185e0f15594017a6f1a191ebe6630cfea5f74","status":"affected","versionType":"git"},{"version":"3948b05950fdd64002a5f182c65ba5cf2d53cf71","lessThan":"f60b41b815826f15c4d0323f923f398c423178d0","status":"affected","versionType":"git"},{"version":"3948b05950fdd64002a5f182c65ba5cf2d53cf71","lessThan":"107b25db61122d8f990987895c2912927b8b6e3f","status":"affected","versionType":"git"}]},{"product":"Linux","vendor":"Linux","defaultStatus":"affected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/net/ethernet/broadcom/bnxt/bnxt.c","drivers/net/ethernet/broadcom/bnxt/bnxt.h","drivers/net/ethernet/broadcom/bnxt/bnxt_xdp.c"],"versions":[{"version":"6.4","status":"affected"},{"version":"0","lessThan":"6.4","status":"unaffected","versionType":"semver"},{"version":"6.12.109","lessThanOrEqual":"6.12.*","status":"unaffected","versionType":"semver"},{"version":"6.14.2","lessThanOrEqual":"6.14.*","status":"unaffected","versionType":"semver"},{"version":"6.15","lessThanOrEqual":"*","status":"unaffected","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.4","versionEndExcluding":"6.12.109"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.4","versionEndExcluding":"6.14.2"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.4","versionEndExcluding":"6.15"}]}]}],"references":[{"url":"https://git.kernel.org/stable/c/9ee185e0f15594017a6f1a191ebe6630cfea5f74"},{"url":"https://git.kernel.org/stable/c/f60b41b815826f15c4d0323f923f398c423178d0"},{"url":"https://git.kernel.org/stable/c/107b25db61122d8f990987895c2912927b8b6e3f"}],"title":"bnxt_en: Mask the bd_cnt field in the TX BD properly","x_generator":{"engine":"bippy-1.2.0"}}}}