CVE-2025-21682 (GCVE-0-2025-21682)
Vulnerability from cvelistv5 – Published: 2025-01-31 11:25 – Updated: 2026-09-08 08:40
VLAI
EPSS
VEX
Title
eth: bnxt: always recalculate features after XDP clearing, fix null-deref
Summary
In the Linux kernel, the following vulnerability has been resolved:
eth: bnxt: always recalculate features after XDP clearing, fix null-deref
Recalculate features when XDP is detached.
Before:
# ip li set dev eth0 xdp obj xdp_dummy.bpf.o sec xdp
# ip li set dev eth0 xdp off
# ethtool -k eth0 | grep gro
rx-gro-hw: off [requested on]
After:
# ip li set dev eth0 xdp obj xdp_dummy.bpf.o sec xdp
# ip li set dev eth0 xdp off
# ethtool -k eth0 | grep gro
rx-gro-hw: on
The fact that HW-GRO doesn't get re-enabled automatically is just
a minor annoyance. The real issue is that the features will randomly
come back during another reconfiguration which just happens to invoke
netdev_update_features(). The driver doesn't handle reconfiguring
two things at a time very robustly.
Starting with commit 98ba1d931f61 ("bnxt_en: Fix RSS logic in
__bnxt_reserve_rings()") we only reconfigure the RSS hash table
if the "effective" number of Rx rings has changed. If HW-GRO is
enabled "effective" number of rings is 2x what user sees.
So if we are in the bad state, with HW-GRO re-enablement "pending"
after XDP off, and we lower the rings by / 2 - the HW-GRO rings
doing 2x and the ethtool -L doing / 2 may cancel each other out,
and the:
if (old_rx_rings != bp->hw_resc.resv_rx_rings &&
condition in __bnxt_reserve_rings() will be false.
The RSS map won't get updated, and we'll crash with:
BUG: kernel NULL pointer dereference, address: 0000000000000168
RIP: 0010:__bnxt_hwrm_vnic_set_rss+0x13a/0x1a0
bnxt_hwrm_vnic_rss_cfg_p5+0x47/0x180
__bnxt_setup_vnic_p5+0x58/0x110
bnxt_init_nic+0xb72/0xf50
__bnxt_open_nic+0x40d/0xab0
bnxt_open_nic+0x2b/0x60
ethtool_set_channels+0x18c/0x1d0
As we try to access a freed ring.
The issue is present since XDP support was added, really, but
prior to commit 98ba1d931f61 ("bnxt_en: Fix RSS logic in
__bnxt_reserve_rings()") it wasn't causing major issues.
Severity
7.3 (High)
5.5 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-10-01 19:51 UTC
CWE
- CWE-476 - NULL Pointer Dereference
Assigner
References
6 references
Impacted products
8 products
| Vendor | Product | Version | CPE status | |
|---|---|---|---|---|
| Linux | Linux |
Affected:
1054aee82321483dceabbb9b9e5d6512e8fe684b , < 076a694a42ae3f0466bc6e4126050eeb7b7d299a
(git)
Affected: 1054aee82321483dceabbb9b9e5d6512e8fe684b , < 90336fc3d6f5e716ac39a9ddbbde453e23a5aa65 (git) Affected: 1054aee82321483dceabbb9b9e5d6512e8fe684b , < 08831a894d18abfaabb5bbde7c2069a7fb41dd93 (git) Affected: 1054aee82321483dceabbb9b9e5d6512e8fe684b , < f0aa6a37a3dbb40b272df5fc6db93c114688adcd (git) |
guessed | |
| Linux | Linux |
Affected:
4.16
Unaffected: 0 , < 4.16 (semver) Unaffected: 6.1.167 , ≤ 6.1.* (semver) Unaffected: 6.6.130 , ≤ 6.6.* (semver) Unaffected: 6.12.11 , ≤ 6.12.* (semver) Unaffected: 6.13 , ≤ * (original_commit_for_fix) |
guessed | |
| Siemens | SIMATIC S7-1500 CPU 1518-4 PN/DP MFP |
Affected:
V3.1.6 , < *
(custom)
|
guessed | |
| Siemens | SIMATIC S7-1500 CPU 1518-4 PN/DP MFP |
Affected:
V3.1.5 , < *
(custom)
|
guessed | |
| Siemens | SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP |
Affected:
V3.1.6 , < *
(custom)
|
guessed | |
| Siemens | SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP |
Affected:
V3.1.5 , < *
(custom)
|
guessed | |
| Siemens | SIPLUS S7-1500 CPU 1518-4 PN/DP MFP |
Affected:
V3.1.6 , < *
(custom)
|
guessed | |
| Siemens | SIPLUS S7-1500 CPU 1518-4 PN/DP MFP |
Affected:
V3.1.5 , < *
(custom)
|
guessed |
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2025-21682",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-10-01T19:51:50.706963Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-476",
"description": "CWE-476 NULL Pointer Dereference",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-10-01T19:57:11.247Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"affected": [
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.6",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.5",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.6",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.5",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.6",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.5",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.6",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.5",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.6",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.5",
"versionType": "custom"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-08T08:40:17.844Z",
"orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
"shortName": "siemens-SADP"
},
"references": [
{
"url": "https://cert-portal.siemens.com/productcert/html/ssa-082556.html"
},
{
"url": "https://cert-portal.siemens.com/productcert/html/ssa-019113.html"
}
],
"x_adpType": "supplier"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/ethernet/broadcom/bnxt/bnxt.c",
"drivers/net/ethernet/broadcom/bnxt/bnxt.h",
"drivers/net/ethernet/broadcom/bnxt/bnxt_xdp.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "076a694a42ae3f0466bc6e4126050eeb7b7d299a",
"status": "affected",
"version": "1054aee82321483dceabbb9b9e5d6512e8fe684b",
"versionType": "git"
},
{
"lessThan": "90336fc3d6f5e716ac39a9ddbbde453e23a5aa65",
"status": "affected",
"version": "1054aee82321483dceabbb9b9e5d6512e8fe684b",
"versionType": "git"
},
{
"lessThan": "08831a894d18abfaabb5bbde7c2069a7fb41dd93",
"status": "affected",
"version": "1054aee82321483dceabbb9b9e5d6512e8fe684b",
"versionType": "git"
},
{
"lessThan": "f0aa6a37a3dbb40b272df5fc6db93c114688adcd",
"status": "affected",
"version": "1054aee82321483dceabbb9b9e5d6512e8fe684b",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/ethernet/broadcom/bnxt/bnxt.c",
"drivers/net/ethernet/broadcom/bnxt/bnxt.h",
"drivers/net/ethernet/broadcom/bnxt/bnxt_xdp.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.16"
},
{
"lessThan": "4.16",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.167",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.130",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.11",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.13",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.167",
"versionStartIncluding": "4.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.130",
"versionStartIncluding": "4.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.11",
"versionStartIncluding": "4.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.13",
"versionStartIncluding": "4.16",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\neth: bnxt: always recalculate features after XDP clearing, fix null-deref\n\nRecalculate features when XDP is detached.\n\nBefore:\n # ip li set dev eth0 xdp obj xdp_dummy.bpf.o sec xdp\n # ip li set dev eth0 xdp off\n # ethtool -k eth0 | grep gro\n rx-gro-hw: off [requested on]\n\nAfter:\n # ip li set dev eth0 xdp obj xdp_dummy.bpf.o sec xdp\n # ip li set dev eth0 xdp off\n # ethtool -k eth0 | grep gro\n rx-gro-hw: on\n\nThe fact that HW-GRO doesn\u0027t get re-enabled automatically is just\na minor annoyance. The real issue is that the features will randomly\ncome back during another reconfiguration which just happens to invoke\nnetdev_update_features(). The driver doesn\u0027t handle reconfiguring\ntwo things at a time very robustly.\n\nStarting with commit 98ba1d931f61 (\"bnxt_en: Fix RSS logic in\n__bnxt_reserve_rings()\") we only reconfigure the RSS hash table\nif the \"effective\" number of Rx rings has changed. If HW-GRO is\nenabled \"effective\" number of rings is 2x what user sees.\nSo if we are in the bad state, with HW-GRO re-enablement \"pending\"\nafter XDP off, and we lower the rings by / 2 - the HW-GRO rings\ndoing 2x and the ethtool -L doing / 2 may cancel each other out,\nand the:\n\n if (old_rx_rings != bp-\u003ehw_resc.resv_rx_rings \u0026\u0026\n\ncondition in __bnxt_reserve_rings() will be false.\nThe RSS map won\u0027t get updated, and we\u0027ll crash with:\n\n BUG: kernel NULL pointer dereference, address: 0000000000000168\n RIP: 0010:__bnxt_hwrm_vnic_set_rss+0x13a/0x1a0\n bnxt_hwrm_vnic_rss_cfg_p5+0x47/0x180\n __bnxt_setup_vnic_p5+0x58/0x110\n bnxt_init_nic+0xb72/0xf50\n __bnxt_open_nic+0x40d/0xab0\n bnxt_open_nic+0x2b/0x60\n ethtool_set_channels+0x18c/0x1d0\n\nAs we try to access a freed ring.\n\nThe issue is present since XDP support was added, really, but\nprior to commit 98ba1d931f61 (\"bnxt_en: Fix RSS logic in\n__bnxt_reserve_rings()\") it wasn\u0027t causing major issues."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.3,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The bug is reached only through local device-configuration interfaces \u2014 RTM_SETLINK for XDP attach/detach and the ethtool set_channels ioctl/netlink call on a bnxt netdev. No remote peer input reaches this code.\nAC:L - The commit gives a deterministic recipe: attach XDP, detach XDP, then halve the ring count so the pending HW-GRO 2x cancels the /2 and the RSS map refresh is skipped. Every input is attacker-chosen, there is no race and no memory-layout condition outside the attacker\u0027s influence.\nPR:L - Both entry points check ns_capable(net-\u003euser_ns, CAP_NET_ADMIN), which is namespace-scoped rather than requiring real root in the init namespace, so a container or namespace-confined user holding a delegated bnxt netdev (such as an SR-IOV VF) can drive the full sequence.\nUI:N - The attacker performs the XDP attach, XDP detach and channel-count change entirely on its own; no other user or administrator action is needed at any point.\nS:U - The out-of-bounds access and resulting crash are confined to the kernel\u0027s own memory and the driver\u0027s hardware configuration, within the same security authority; no VM, IOMMU or sandbox boundary is crossed.\nC:H - bnxt_fill_hw_rss_tbl_p5() indexes bp-\u003erx_ring with stale RSS indices past the end of the newly kcalloc\u0027d array, reading adjacent heap objects and then dereferencing an rx_cpr pointer taken from that out-of-bounds memory, which with heap grooming becomes an attacker-influenced arbitrary-address read.\nI:L - There is no out-of-bounds write, but garbage ring IDs harvested from the out-of-bounds read are programmed into the NIC\u0027s RSS indirection table, corrupting hardware receive steering \u2014 a bounded but real modification of state.\nA:H - The dereference of the NULL/wild rx_cpr pointer oopses inside __bnxt_open_nic() while holding rtnl_lock, taking down the network device and typically panicking or wedging the machine."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T11:53:36.562Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/076a694a42ae3f0466bc6e4126050eeb7b7d299a"
},
{
"url": "https://git.kernel.org/stable/c/90336fc3d6f5e716ac39a9ddbbde453e23a5aa65"
},
{
"url": "https://git.kernel.org/stable/c/08831a894d18abfaabb5bbde7c2069a7fb41dd93"
},
{
"url": "https://git.kernel.org/stable/c/f0aa6a37a3dbb40b272df5fc6db93c114688adcd"
}
],
"title": "eth: bnxt: always recalculate features after XDP clearing, fix null-deref",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2025-21682",
"datePublished": "2025-01-31T11:25:42.160Z",
"dateReserved": "2024-12-29T08:45:45.739Z",
"dateUpdated": "2026-09-08T08:40:17.844Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"vulnerability-lookup:meta": {
"epss": {
"cve": "CVE-2025-21682",
"date": "2026-09-14",
"epss": "0.00233",
"percentile": "0.14277"
},
"microsoft_vex": {
"current_release_date": "2026-08-11T01:46:16.000Z",
"cve": "CVE-2025-21682",
"id": "msrc_CVE-2025-21682",
"initial_release_date": "2025-09-03T21:21:53.000Z",
"product_status:fixed": "1",
"product_status:known_affected": "1",
"product_status:under_investigation": "13",
"source": "Microsoft CSAF VEX",
"status": "final",
"title": "eth: bnxt: always recalculate features after XDP clearing, fix null-deref",
"url": "https://msrc.microsoft.com/csaf/vex/2025/msrc_cve-2025-21682.json",
"version": "11"
},
"nvd": "{\"cve\":{\"id\":\"CVE-2025-21682\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-01-31T12:15:29.363\",\"lastModified\":\"2026-07-30T06:18:52.927\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\neth: bnxt: always recalculate features after XDP clearing, fix null-deref\\n\\nRecalculate features when XDP is detached.\\n\\nBefore:\\n # ip li set dev eth0 xdp obj xdp_dummy.bpf.o sec xdp\\n # ip li set dev eth0 xdp off\\n # ethtool -k eth0 | grep gro\\n rx-gro-hw: off [requested on]\\n\\nAfter:\\n # ip li set dev eth0 xdp obj xdp_dummy.bpf.o sec xdp\\n # ip li set dev eth0 xdp off\\n # ethtool -k eth0 | grep gro\\n rx-gro-hw: on\\n\\nThe fact that HW-GRO doesn\u0027t get re-enabled automatically is just\\na minor annoyance. The real issue is that the features will randomly\\ncome back during another reconfiguration which just happens to invoke\\nnetdev_update_features(). The driver doesn\u0027t handle reconfiguring\\ntwo things at a time very robustly.\\n\\nStarting with commit 98ba1d931f61 (\\\"bnxt_en: Fix RSS logic in\\n__bnxt_reserve_rings()\\\") we only reconfigure the RSS hash table\\nif the \\\"effective\\\" number of Rx rings has changed. If HW-GRO is\\nenabled \\\"effective\\\" number of rings is 2x what user sees.\\nSo if we are in the bad state, with HW-GRO re-enablement \\\"pending\\\"\\nafter XDP off, and we lower the rings by / 2 - the HW-GRO rings\\ndoing 2x and the ethtool -L doing / 2 may cancel each other out,\\nand the:\\n\\n if (old_rx_rings != bp-\u003ehw_resc.resv_rx_rings \u0026\u0026\\n\\ncondition in __bnxt_reserve_rings() will be false.\\nThe RSS map won\u0027t get updated, and we\u0027ll crash with:\\n\\n BUG: kernel NULL pointer dereference, address: 0000000000000168\\n RIP: 0010:__bnxt_hwrm_vnic_set_rss+0x13a/0x1a0\\n bnxt_hwrm_vnic_rss_cfg_p5+0x47/0x180\\n __bnxt_setup_vnic_p5+0x58/0x110\\n bnxt_init_nic+0xb72/0xf50\\n __bnxt_open_nic+0x40d/0xab0\\n bnxt_open_nic+0x2b/0x60\\n ethtool_set_channels+0x18c/0x1d0\\n\\nAs we try to access a freed ring.\\n\\nThe issue is present since XDP support was added, really, but\\nprior to commit 98ba1d931f61 (\\\"bnxt_en: Fix RSS logic in\\n__bnxt_reserve_rings()\\\") it wasn\u0027t causing major issues.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: eth: bnxt: siempre recalcula las caracter\u00edsticas despu\u00e9s de borrar XDP, corrige null-deref Recalcula las caracter\u00edsticas cuando se desconecta XDP. Antes: # ip li set dev eth0 xdp obj xdp_dummy.bpf.o sec xdp # ip li set dev eth0 xdp off # ethtool -k eth0 | grep gro rx-gro-hw: off [solicitado el] Despu\u00e9s: # ip li set dev eth0 xdp obj xdp_dummy.bpf.o sec xdp # ip li set dev eth0 xdp off # ethtool -k eth0 | grep gro rx-gro-hw: on El hecho de que HW-GRO no se vuelva a habilitar autom\u00e1ticamente es solo una molestia menor. El problema real es que las funciones volver\u00e1n de forma aleatoria durante otra reconfiguraci\u00f3n que invoca netdev_update_features(). El controlador no gestiona la reconfiguraci\u00f3n de dos cosas a la vez de forma muy robusta. A partir de el commit 98ba1d931f61 (\\\"bnxt_en: Fix RSS logic in __bnxt_reserve_rings()\\\"), solo reconfiguramos la tabla hash RSS si el n\u00famero \\\"efectivo\\\" de anillos Rx ha cambiado. Si HW-GRO est\u00e1 habilitado, el n\u00famero \\\"efectivo\\\" de anillos es el doble de lo que ve el usuario. Entonces, si estamos en un mal estado, con la rehabilitaci\u00f3n de HW-GRO \\\"pendiente\\\" despu\u00e9s de desactivar XDP, y reducimos los anillos en / 2, los anillos de HW-GRO haciendo 2x y ethtool -L haciendo / 2 pueden cancelarse entre s\u00ed, y la condici\u00f3n: if (old_rx_rings != bp-\u0026gt;hw_resc.resv_rx_rings \u0026amp;\u0026amp; en __bnxt_reserve_rings() ser\u00e1 falsa. El mapa RSS no se actualizar\u00e1 y nos bloquearemos con: ERROR: desreferencia de puntero NULL del kernel, direcci\u00f3n: 0000000000000168 RIP: 0010:__bnxt_hwrm_vnic_set_rss+0x13a/0x1a0 bnxt_hwrm_vnic_rss_cfg_p5+0x47/0x180 __bnxt_setup_vnic_p5+0x58/0x110 bnxt_init_nic+0xb72/0xf50 __bnxt_open_nic+0x40d/0xab0 bnxt_open_nic+0x2b/0x60 ethtool_set_channels+0x18c/0x1d0 Cuando intentamos acceder a un anillo liberado, el problema est\u00e1 presente desde que se agreg\u00f3 la compatibilidad con XDP, pero antes de el commit 98ba1d931f61 (\\\"bnxt_en: Fix RSS logic in __bnxt_reserve_rings()\\\") no causaba problemas importantes.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/net/ethernet/broadcom/bnxt/bnxt.c\",\"drivers/net/ethernet/broadcom/bnxt/bnxt.h\",\"drivers/net/ethernet/broadcom/bnxt/bnxt_xdp.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"1054aee82321483dceabbb9b9e5d6512e8fe684b\",\"lessThan\":\"076a694a42ae3f0466bc6e4126050eeb7b7d299a\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"1054aee82321483dceabbb9b9e5d6512e8fe684b\",\"lessThan\":\"90336fc3d6f5e716ac39a9ddbbde453e23a5aa65\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"1054aee82321483dceabbb9b9e5d6512e8fe684b\",\"lessThan\":\"08831a894d18abfaabb5bbde7c2069a7fb41dd93\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"1054aee82321483dceabbb9b9e5d6512e8fe684b\",\"lessThan\":\"f0aa6a37a3dbb40b272df5fc6db93c114688adcd\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/net/ethernet/broadcom/bnxt/bnxt.c\",\"drivers/net/ethernet/broadcom/bnxt/bnxt.h\",\"drivers/net/ethernet/broadcom/bnxt/bnxt_xdp.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"4.16\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"4.16\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.167\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.130\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.11\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.13\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]},{\"source\":\"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e\",\"affectedData\":[{\"vendor\":\"Siemens\",\"product\":\"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP\",\"defaultStatus\":\"unknown\",\"versions\":[{\"version\":\"V3.1.6\",\"lessThan\":\"*\",\"versionType\":\"custom\",\"status\":\"affected\"}]},{\"vendor\":\"Siemens\",\"product\":\"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP\",\"defaultStatus\":\"unknown\",\"versions\":[{\"version\":\"V3.1.5\",\"lessThan\":\"*\",\"versionType\":\"custom\",\"status\":\"affected\"}]},{\"vendor\":\"Siemens\",\"product\":\"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP\",\"defaultStatus\":\"unknown\",\"versions\":[{\"version\":\"V3.1.6\",\"lessThan\":\"*\",\"versionType\":\"custom\",\"status\":\"affected\"}]},{\"vendor\":\"Siemens\",\"product\":\"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP\",\"defaultStatus\":\"unknown\",\"versions\":[{\"version\":\"V3.1.5\",\"lessThan\":\"*\",\"versionType\":\"custom\",\"status\":\"affected\"}]},{\"vendor\":\"Siemens\",\"product\":\"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP\",\"defaultStatus\":\"unknown\",\"versions\":[{\"version\":\"V3.1.6\",\"lessThan\":\"*\",\"versionType\":\"custom\",\"status\":\"affected\"}]},{\"vendor\":\"Siemens\",\"product\":\"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP\",\"defaultStatus\":\"unknown\",\"versions\":[{\"version\":\"V3.1.5\",\"lessThan\":\"*\",\"versionType\":\"custom\",\"status\":\"affected\"}]},{\"vendor\":\"Siemens\",\"product\":\"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP\",\"defaultStatus\":\"unknown\",\"versions\":[{\"version\":\"V3.1.6\",\"lessThan\":\"*\",\"versionType\":\"custom\",\"status\":\"affected\"}]},{\"vendor\":\"Siemens\",\"product\":\"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP\",\"defaultStatus\":\"unknown\",\"versions\":[{\"version\":\"V3.1.5\",\"lessThan\":\"*\",\"versionType\":\"custom\",\"status\":\"affected\"}]},{\"vendor\":\"Siemens\",\"product\":\"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP\",\"defaultStatus\":\"unknown\",\"versions\":[{\"version\":\"V3.1.6\",\"lessThan\":\"*\",\"versionType\":\"custom\",\"status\":\"affected\"}]},{\"vendor\":\"Siemens\",\"product\":\"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP\",\"defaultStatus\":\"unknown\",\"versions\":[{\"version\":\"V3.1.5\",\"lessThan\":\"*\",\"versionType\":\"custom\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H\",\"baseScore\":7.3,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"LOW\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.5},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6},{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2025-10-01T19:51:50.706963Z\",\"id\":\"CVE-2025-21682\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-476\"}]},{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-476\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.16\",\"versionEndExcluding\":\"6.12.11\",\"matchCriteriaId\":\"D85A4303-7769-4ADC-A840-D2F38DB827CE\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.13:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"62567B3C-6CEE-46D0-BC2E-B3717FBF7D13\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.13:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"5A073481-106D-4B15-B4C7-FB0213B8E1D4\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.13:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"DE491969-75AE-4A6B-9A58-8FC5AF98798F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.13:rc4:*:*:*:*:*:*\",\"matchCriteriaId\":\"93C0660D-7FB8-4FBA-892A-B064BA71E49E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.13:rc5:*:*:*:*:*:*\",\"matchCriteriaId\":\"034C36A6-C481-41F3-AE9A-D116E5BE6895\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.13:rc6:*:*:*:*:*:*\",\"matchCriteriaId\":\"8AF9DC49-2085-4FFB-A7E3-73DFAFECC7F2\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.13:rc7:*:*:*:*:*:*\",\"matchCriteriaId\":\"5DFCDFB8-4FD0-465A-9076-D813D78FE51B\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/076a694a42ae3f0466bc6e4126050eeb7b7d299a\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/08831a894d18abfaabb5bbde7c2069a7fb41dd93\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/90336fc3d6f5e716ac39a9ddbbde453e23a5aa65\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/f0aa6a37a3dbb40b272df5fc6db93c114688adcd\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://cert-portal.siemens.com/productcert/html/ssa-019113.html\",\"source\":\"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e\"},{\"url\":\"https://cert-portal.siemens.com/productcert/html/ssa-082556.html\",\"source\":\"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e\"}]}}",
"redhat_vex": {
"aggregate_severity": "Moderate",
"current_release_date": "2026-09-08T11:37:15+00:00",
"cve": "CVE-2025-21682",
"id": "CVE-2025-21682",
"initial_release_date": "2025-01-31T00:00:00+00:00",
"product_status:known_affected": "260",
"product_status:known_not_affected": "14",
"source": "Red Hat CSAF VEX",
"status": "final",
"title": "kernel: eth: bnxt: always recalculate features after XDP clearing, fix null-deref",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-21682.json",
"version": "3"
},
"suse_vex": {
"aggregate_severity": "moderate",
"current_release_date": "2026-09-11T02:03:21Z",
"cve": "CVE-2025-21682",
"id": "CVE-2025-21682",
"initial_release_date": "2025-02-01T03:47:22Z",
"product_status:known_affected": "718",
"product_status:known_not_affected": "68",
"product_status:recommended": "384",
"source": "SUSE CSAF VEX",
"status": "interim",
"title": "SUSE CVE CVE-2025-21682",
"url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2025-21682.json",
"version": "63"
},
"vulnrichment": {
"containers": "{\"adp\": [{\"affected\": [{\"vendor\": \"Siemens\", \"product\": \"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP\", \"versions\": [{\"status\": \"affected\", \"version\": \"V3.1.6\", \"lessThan\": \"*\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unknown\"}, {\"vendor\": \"Siemens\", \"product\": \"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP\", \"versions\": [{\"status\": \"affected\", \"version\": \"V3.1.5\", \"lessThan\": \"*\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unknown\"}, {\"vendor\": \"Siemens\", \"product\": \"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP\", \"versions\": [{\"status\": \"affected\", \"version\": \"V3.1.6\", \"lessThan\": \"*\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unknown\"}, {\"vendor\": \"Siemens\", \"product\": \"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP\", \"versions\": [{\"status\": \"affected\", \"version\": \"V3.1.5\", \"lessThan\": \"*\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unknown\"}, {\"vendor\": \"Siemens\", \"product\": \"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP\", \"versions\": [{\"status\": \"affected\", \"version\": \"V3.1.6\", \"lessThan\": \"*\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unknown\"}, {\"vendor\": \"Siemens\", \"product\": \"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP\", \"versions\": [{\"status\": \"affected\", \"version\": \"V3.1.5\", \"lessThan\": \"*\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unknown\"}, {\"vendor\": \"Siemens\", \"product\": \"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP\", \"versions\": [{\"status\": \"affected\", \"version\": \"V3.1.6\", \"lessThan\": \"*\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unknown\"}, {\"vendor\": \"Siemens\", \"product\": \"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP\", \"versions\": [{\"status\": \"affected\", \"version\": \"V3.1.5\", \"lessThan\": \"*\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unknown\"}, {\"vendor\": \"Siemens\", \"product\": \"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP\", \"versions\": [{\"status\": \"affected\", \"version\": \"V3.1.6\", \"lessThan\": \"*\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unknown\"}, {\"vendor\": \"Siemens\", \"product\": \"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP\", \"versions\": [{\"status\": \"affected\", \"version\": \"V3.1.5\", \"lessThan\": \"*\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unknown\"}], \"x_adpType\": \"supplier\", \"references\": [{\"url\": \"https://cert-portal.siemens.com/productcert/html/ssa-082556.html\"}, {\"url\": \"https://cert-portal.siemens.com/productcert/html/ssa-019113.html\"}], \"providerMetadata\": {\"orgId\": \"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e\", \"shortName\": \"siemens-SADP\", \"dateUpdated\": \"2026-09-08T08:40:17.844Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 5.5, \"attackVector\": \"LOCAL\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\", \"integrityImpact\": \"NONE\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"NONE\"}}, {\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2025-21682\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2025-10-01T19:51:50.706963Z\"}}}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-476\", \"description\": \"CWE-476 NULL Pointer Dereference\"}]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2025-10-01T15:59:14.025Z\"}}], \"cna\": {\"title\": \"eth: bnxt: always recalculate features after XDP clearing, fix null-deref\", \"metrics\": [{\"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 7.3, \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"AV:L - The bug is reached only through local device-configuration interfaces \\u2014 RTM_SETLINK for XDP attach/detach and the ethtool set_channels ioctl/netlink call on a bnxt netdev. No remote peer input reaches this code.\\nAC:L - The commit gives a deterministic recipe: attach XDP, detach XDP, then halve the ring count so the pending HW-GRO 2x cancels the /2 and the RSS map refresh is skipped. Every input is attacker-chosen, there is no race and no memory-layout condition outside the attacker\u0027s influence.\\nPR:L - Both entry points check ns_capable(net-\u003euser_ns, CAP_NET_ADMIN), which is namespace-scoped rather than requiring real root in the init namespace, so a container or namespace-confined user holding a delegated bnxt netdev (such as an SR-IOV VF) can drive the full sequence.\\nUI:N - The attacker performs the XDP attach, XDP detach and channel-count change entirely on its own; no other user or administrator action is needed at any point.\\nS:U - The out-of-bounds access and resulting crash are confined to the kernel\u0027s own memory and the driver\u0027s hardware configuration, within the same security authority; no VM, IOMMU or sandbox boundary is crossed.\\nC:H - bnxt_fill_hw_rss_tbl_p5() indexes bp-\u003erx_ring with stale RSS indices past the end of the newly kcalloc\u0027d array, reading adjacent heap objects and then dereferencing an rx_cpr pointer taken from that out-of-bounds memory, which with heap grooming becomes an attacker-influenced arbitrary-address read.\\nI:L - There is no out-of-bounds write, but garbage ring IDs harvested from the out-of-bounds read are programmed into the NIC\u0027s RSS indirection table, corrupting hardware receive steering \\u2014 a bounded but real modification of state.\\nA:H - The dereference of the NULL/wild rx_cpr pointer oopses inside __bnxt_open_nic() while holding rtnl_lock, taking down the network device and typically panicking or wedging the machine.\"}]}], \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"1054aee82321483dceabbb9b9e5d6512e8fe684b\", \"lessThan\": \"076a694a42ae3f0466bc6e4126050eeb7b7d299a\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"1054aee82321483dceabbb9b9e5d6512e8fe684b\", \"lessThan\": \"90336fc3d6f5e716ac39a9ddbbde453e23a5aa65\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"1054aee82321483dceabbb9b9e5d6512e8fe684b\", \"lessThan\": \"08831a894d18abfaabb5bbde7c2069a7fb41dd93\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"1054aee82321483dceabbb9b9e5d6512e8fe684b\", \"lessThan\": \"f0aa6a37a3dbb40b272df5fc6db93c114688adcd\", \"versionType\": \"git\"}], \"programFiles\": [\"drivers/net/ethernet/broadcom/bnxt/bnxt.c\", \"drivers/net/ethernet/broadcom/bnxt/bnxt.h\", \"drivers/net/ethernet/broadcom/bnxt/bnxt_xdp.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"4.16\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"4.16\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"6.1.167\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.1.*\"}, {\"status\": \"unaffected\", \"version\": \"6.6.130\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.6.*\"}, {\"status\": \"unaffected\", \"version\": \"6.12.11\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.12.*\"}, {\"status\": \"unaffected\", \"version\": \"6.13\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"drivers/net/ethernet/broadcom/bnxt/bnxt.c\", \"drivers/net/ethernet/broadcom/bnxt/bnxt.h\", \"drivers/net/ethernet/broadcom/bnxt/bnxt_xdp.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/076a694a42ae3f0466bc6e4126050eeb7b7d299a\"}, {\"url\": \"https://git.kernel.org/stable/c/90336fc3d6f5e716ac39a9ddbbde453e23a5aa65\"}, {\"url\": \"https://git.kernel.org/stable/c/08831a894d18abfaabb5bbde7c2069a7fb41dd93\"}, {\"url\": \"https://git.kernel.org/stable/c/f0aa6a37a3dbb40b272df5fc6db93c114688adcd\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\neth: bnxt: always recalculate features after XDP clearing, fix null-deref\\n\\nRecalculate features when XDP is detached.\\n\\nBefore:\\n # ip li set dev eth0 xdp obj xdp_dummy.bpf.o sec xdp\\n # ip li set dev eth0 xdp off\\n # ethtool -k eth0 | grep gro\\n rx-gro-hw: off [requested on]\\n\\nAfter:\\n # ip li set dev eth0 xdp obj xdp_dummy.bpf.o sec xdp\\n # ip li set dev eth0 xdp off\\n # ethtool -k eth0 | grep gro\\n rx-gro-hw: on\\n\\nThe fact that HW-GRO doesn\u0027t get re-enabled automatically is just\\na minor annoyance. The real issue is that the features will randomly\\ncome back during another reconfiguration which just happens to invoke\\nnetdev_update_features(). The driver doesn\u0027t handle reconfiguring\\ntwo things at a time very robustly.\\n\\nStarting with commit 98ba1d931f61 (\\\"bnxt_en: Fix RSS logic in\\n__bnxt_reserve_rings()\\\") we only reconfigure the RSS hash table\\nif the \\\"effective\\\" number of Rx rings has changed. If HW-GRO is\\nenabled \\\"effective\\\" number of rings is 2x what user sees.\\nSo if we are in the bad state, with HW-GRO re-enablement \\\"pending\\\"\\nafter XDP off, and we lower the rings by / 2 - the HW-GRO rings\\ndoing 2x and the ethtool -L doing / 2 may cancel each other out,\\nand the:\\n\\n if (old_rx_rings != bp-\u003ehw_resc.resv_rx_rings \u0026\u0026\\n\\ncondition in __bnxt_reserve_rings() will be false.\\nThe RSS map won\u0027t get updated, and we\u0027ll crash with:\\n\\n BUG: kernel NULL pointer dereference, address: 0000000000000168\\n RIP: 0010:__bnxt_hwrm_vnic_set_rss+0x13a/0x1a0\\n bnxt_hwrm_vnic_rss_cfg_p5+0x47/0x180\\n __bnxt_setup_vnic_p5+0x58/0x110\\n bnxt_init_nic+0xb72/0xf50\\n __bnxt_open_nic+0x40d/0xab0\\n bnxt_open_nic+0x2b/0x60\\n ethtool_set_channels+0x18c/0x1d0\\n\\nAs we try to access a freed ring.\\n\\nThe issue is present since XDP support was added, really, but\\nprior to commit 98ba1d931f61 (\\\"bnxt_en: Fix RSS logic in\\n__bnxt_reserve_rings()\\\") it wasn\u0027t causing major issues.\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.1.167\", \"versionStartIncluding\": \"4.16\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.6.130\", \"versionStartIncluding\": \"4.16\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.12.11\", \"versionStartIncluding\": \"4.16\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.13\", \"versionStartIncluding\": \"4.16\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-08-05T11:53:36.562Z\"}}}",
"cveMetadata": "{\"cveId\": \"CVE-2025-21682\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-09-08T08:40:17.844Z\", \"dateReserved\": \"2024-12-29T08:45:45.739Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2025-01-31T11:25:42.160Z\", \"assignerShortName\": \"Linux\"}",
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
}
}
Loading…
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Loading…
Loading…