CVE-2025-37911 (GCVE-0-2025-37911)

Vulnerability from cvelistv5 – Published: 2025-05-20 15:21 – Updated: 2026-08-05 11:58
VLAI
Title
bnxt_en: Fix out-of-bound memcpy() during ethtool -w
Summary
In the Linux kernel, the following vulnerability has been resolved: bnxt_en: Fix out-of-bound memcpy() during ethtool -w When retrieving the FW coredump using ethtool, it can sometimes cause memory corruption: BUG: KFENCE: memory corruption in __bnxt_get_coredump+0x3ef/0x670 [bnxt_en] Corrupted memory at 0x000000008f0f30e8 [ ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ] (in kfence-#45): __bnxt_get_coredump+0x3ef/0x670 [bnxt_en] ethtool_get_dump_data+0xdc/0x1a0 __dev_ethtool+0xa1e/0x1af0 dev_ethtool+0xa8/0x170 dev_ioctl+0x1b5/0x580 sock_do_ioctl+0xab/0xf0 sock_ioctl+0x1ce/0x2e0 __x64_sys_ioctl+0x87/0xc0 do_syscall_64+0x5c/0xf0 entry_SYSCALL_64_after_hwframe+0x78/0x80 ... This happens when copying the coredump segment list in bnxt_hwrm_dbg_dma_data() with the HWRM_DBG_COREDUMP_LIST FW command. The info->dest_buf buffer is allocated based on the number of coredump segments returned by the FW. The segment list is then DMA'ed by the FW and the length of the DMA is returned by FW. The driver then copies this DMA'ed segment list to info->dest_buf. In some cases, this DMA length may exceed the info->dest_buf length and cause the above BUG condition. Fix it by capping the copy length to not exceed the length of info->dest_buf. The extra DMA data contains no useful information. This code path is shared for the HWRM_DBG_COREDUMP_LIST and the HWRM_DBG_COREDUMP_RETRIEVE FW commands. The buffering is different for these 2 FW commands. To simplify the logic, we need to move the line to adjust the buffer length for HWRM_DBG_COREDUMP_RETRIEVE up, so that the new check to cap the copy length will work for both commands.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: c74751f4c39232c31214ec6a3bc1c7e62f5c728b , < 69b10dd23ab826d0c7f2d9ab311842251978d0c1 (git)
Affected: c74751f4c39232c31214ec6a3bc1c7e62f5c728b , < 43292b83424158fa6ec458799f3cb9c54d18c484 (git)
Affected: c74751f4c39232c31214ec6a3bc1c7e62f5c728b , < 4d69864915a3a052538e4ba76cd6fd77cfc64ebe (git)
Affected: c74751f4c39232c31214ec6a3bc1c7e62f5c728b , < 44807af79efd0d78fa36383dd865ddfe7992c0a6 (git)
Affected: c74751f4c39232c31214ec6a3bc1c7e62f5c728b , < 44d81a9ebf0cad92512e0ffdf7412bfe20db66ec (git)
Affected: c74751f4c39232c31214ec6a3bc1c7e62f5c728b , < 6b87bd94f34370bbf1dfa59352bed8efab5bf419 (git)
Affected: 4bf973a1f84aefb64750bdb3afe72d54de3199d7 (git)
Affected: a76837dd731b68cc3b5690470bc9efa2a8e3801a (git)
Affected: 4.19.95 , < 4.20 (semver)
Affected: 5.4.8 , < 5.5 (semver)
Create a notification for this product.
Linux Linux Affected: 5.5
Unaffected: 0 , < 5.5 (semver)
Unaffected: 5.15.182 , ≤ 5.15.* (semver)
Unaffected: 6.1.138 , ≤ 6.1.* (semver)
Unaffected: 6.6.90 , ≤ 6.6.* (semver)
Unaffected: 6.12.28 , ≤ 6.12.* (semver)
Unaffected: 6.14.6 , ≤ 6.14.* (semver)
Unaffected: 6.15 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T19:57:12.296Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/08/msg00010.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/broadcom/bnxt/bnxt_coredump.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "69b10dd23ab826d0c7f2d9ab311842251978d0c1",
              "status": "affected",
              "version": "c74751f4c39232c31214ec6a3bc1c7e62f5c728b",
              "versionType": "git"
            },
            {
              "lessThan": "43292b83424158fa6ec458799f3cb9c54d18c484",
              "status": "affected",
              "version": "c74751f4c39232c31214ec6a3bc1c7e62f5c728b",
              "versionType": "git"
            },
            {
              "lessThan": "4d69864915a3a052538e4ba76cd6fd77cfc64ebe",
              "status": "affected",
              "version": "c74751f4c39232c31214ec6a3bc1c7e62f5c728b",
              "versionType": "git"
            },
            {
              "lessThan": "44807af79efd0d78fa36383dd865ddfe7992c0a6",
              "status": "affected",
              "version": "c74751f4c39232c31214ec6a3bc1c7e62f5c728b",
              "versionType": "git"
            },
            {
              "lessThan": "44d81a9ebf0cad92512e0ffdf7412bfe20db66ec",
              "status": "affected",
              "version": "c74751f4c39232c31214ec6a3bc1c7e62f5c728b",
              "versionType": "git"
            },
            {
              "lessThan": "6b87bd94f34370bbf1dfa59352bed8efab5bf419",
              "status": "affected",
              "version": "c74751f4c39232c31214ec6a3bc1c7e62f5c728b",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "4bf973a1f84aefb64750bdb3afe72d54de3199d7",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "a76837dd731b68cc3b5690470bc9efa2a8e3801a",
              "versionType": "git"
            },
            {
              "lessThan": "4.20",
              "status": "affected",
              "version": "4.19.95",
              "versionType": "semver"
            },
            {
              "lessThan": "5.5",
              "status": "affected",
              "version": "5.4.8",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/broadcom/bnxt/bnxt_coredump.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.5"
            },
            {
              "lessThan": "5.5",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.182",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.138",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.90",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.28",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.14.*",
              "status": "unaffected",
              "version": "6.14.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.15",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.182",
                  "versionStartIncluding": "5.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.138",
                  "versionStartIncluding": "5.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.90",
                  "versionStartIncluding": "5.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.28",
                  "versionStartIncluding": "5.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.14.6",
                  "versionStartIncluding": "5.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.15",
                  "versionStartIncluding": "5.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "4.19.95",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "5.4.8",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbnxt_en: Fix out-of-bound memcpy() during ethtool -w\n\nWhen retrieving the FW coredump using ethtool, it can sometimes cause\nmemory corruption:\n\nBUG: KFENCE: memory corruption in __bnxt_get_coredump+0x3ef/0x670 [bnxt_en]\nCorrupted memory at 0x000000008f0f30e8 [ ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ] (in kfence-#45):\n__bnxt_get_coredump+0x3ef/0x670 [bnxt_en]\nethtool_get_dump_data+0xdc/0x1a0\n__dev_ethtool+0xa1e/0x1af0\ndev_ethtool+0xa8/0x170\ndev_ioctl+0x1b5/0x580\nsock_do_ioctl+0xab/0xf0\nsock_ioctl+0x1ce/0x2e0\n__x64_sys_ioctl+0x87/0xc0\ndo_syscall_64+0x5c/0xf0\nentry_SYSCALL_64_after_hwframe+0x78/0x80\n\n...\n\nThis happens when copying the coredump segment list in\nbnxt_hwrm_dbg_dma_data() with the HWRM_DBG_COREDUMP_LIST FW command.\nThe info-\u003edest_buf buffer is allocated based on the number of coredump\nsegments returned by the FW.  The segment list is then DMA\u0027ed by\nthe FW and the length of the DMA is returned by FW.  The driver then\ncopies this DMA\u0027ed segment list to info-\u003edest_buf.\n\nIn some cases, this DMA length may exceed the info-\u003edest_buf length\nand cause the above BUG condition.  Fix it by capping the copy\nlength to not exceed the length of info-\u003edest_buf.  The extra\nDMA data contains no useful information.\n\nThis code path is shared for the HWRM_DBG_COREDUMP_LIST and the\nHWRM_DBG_COREDUMP_RETRIEVE FW commands.  The buffering is different\nfor these 2 FW commands.  To simplify the logic, we need to move\nthe line to adjust the buffer length for HWRM_DBG_COREDUMP_RETRIEVE\nup, so that the new check to cap the copy length will work for both\ncommands."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The bug is reached through the ETHTOOL_GET_DUMP_DATA ioctl on a socket (sock_ioctl \u2192 dev_ioctl \u2192 dev_ethtool \u2192 ethtool_get_dump_data \u2192 bnxt_get_dump_data), which requires local system access; there is no remote or adjacent-network path into bnxt_hwrm_dbg_dma_data().\nAC:L - On an affected bnxt_en adapter the attacker simply issues `ethtool -w` repeatedly and the firmware-reported DMA length deterministically exceeds the kmalloc(segs * 16) coredump-list buffer, so the out-of-bounds memcpy() is triggered reliably with no race to win and no memory layout the attacker must guess.\nPR:L - __dev_ethtool() gates ETHTOOL_GET_DUMP_DATA behind ns_capable(net-\u003euser_ns, CAP_NET_ADMIN), which is namespace-relative rather than real root \u2014 an unprivileged user who is namespace-root over a net namespace holding a bnxt netdev (e.g. an SR-IOV VF handed to a container, a very common deployment for these Broadcom NICs in cloud/Kubernetes hosts) satisfies it, so basic local user privileges suffice.\nUI:N - The attacker triggers the coredump retrieval entirely on their own via the ioctl; no administrator or other victim needs to perform any action.\nS:U - The heap corruption occurs in kernel slab memory within the same security authority as the kernel itself; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - The unchecked memcpy() overflows a small kmalloc\u0027d slab object with up to ~2KB of firmware data (and can also read past the 2048-byte DMA slice when the FW-reported len is larger), and such slab corruption of adjacent objects is a general primitive that can be steered into kernel information disclosure.\nI:H - This is a heap out-of-bounds write \u2014 memcpy(info-\u003edest_buf + off, dma_buf, len) with len unbounded by info-\u003edest_buf_size (the guard against BNXT_COREDUMP_BUF_LEN(0) underflows to a huge value and never fires for HWRM_DBG_COREDUMP_LIST) \u2014 corrupting adjacent slab objects, which is the classic basis for control-flow hijack and privilege escalation.\nA:H - The reported KFENCE splat shows real memory corruption in __bnxt_get_coredump(); overflowing neighbouring slab objects readily produces oopses and kernel panics, and the attacker can repeat the ioctl at will."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:58:15.426Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/69b10dd23ab826d0c7f2d9ab311842251978d0c1"
        },
        {
          "url": "https://git.kernel.org/stable/c/43292b83424158fa6ec458799f3cb9c54d18c484"
        },
        {
          "url": "https://git.kernel.org/stable/c/4d69864915a3a052538e4ba76cd6fd77cfc64ebe"
        },
        {
          "url": "https://git.kernel.org/stable/c/44807af79efd0d78fa36383dd865ddfe7992c0a6"
        },
        {
          "url": "https://git.kernel.org/stable/c/44d81a9ebf0cad92512e0ffdf7412bfe20db66ec"
        },
        {
          "url": "https://git.kernel.org/stable/c/6b87bd94f34370bbf1dfa59352bed8efab5bf419"
        }
      ],
      "title": "bnxt_en: Fix out-of-bound memcpy() during ethtool -w",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-37911",
    "datePublished": "2025-05-20T15:21:43.278Z",
    "dateReserved": "2025-04-16T04:51:23.967Z",
    "dateUpdated": "2026-08-05T11:58:15.426Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-37911",
      "date": "2026-08-05",
      "epss": "0.00175",
      "percentile": "0.0722"
    },
    "microsoft_vex": {
      "current_release_date": "2026-02-18T02:02:27.000Z",
      "cve": "CVE-2025-37911",
      "id": "msrc_CVE-2025-37911",
      "initial_release_date": "2025-05-02T00:00:00.000Z",
      "product_status:fixed": "2",
      "product_status:known_affected": "2",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "bnxt_en: Fix out-of-bound memcpy() during ethtool -w",
      "url": "https://msrc.microsoft.com/csaf/vex/2025/msrc_cve-2025-37911.json",
      "version": "2"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-37911\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-05-20T16:15:27.610\",\"lastModified\":\"2026-07-30T06:22:32.080\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nbnxt_en: Fix out-of-bound memcpy() during ethtool -w\\n\\nWhen retrieving the FW coredump using ethtool, it can sometimes cause\\nmemory corruption:\\n\\nBUG: KFENCE: memory corruption in __bnxt_get_coredump+0x3ef/0x670 [bnxt_en]\\nCorrupted memory at 0x000000008f0f30e8 [ ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ] (in kfence-#45):\\n__bnxt_get_coredump+0x3ef/0x670 [bnxt_en]\\nethtool_get_dump_data+0xdc/0x1a0\\n__dev_ethtool+0xa1e/0x1af0\\ndev_ethtool+0xa8/0x170\\ndev_ioctl+0x1b5/0x580\\nsock_do_ioctl+0xab/0xf0\\nsock_ioctl+0x1ce/0x2e0\\n__x64_sys_ioctl+0x87/0xc0\\ndo_syscall_64+0x5c/0xf0\\nentry_SYSCALL_64_after_hwframe+0x78/0x80\\n\\n...\\n\\nThis happens when copying the coredump segment list in\\nbnxt_hwrm_dbg_dma_data() with the HWRM_DBG_COREDUMP_LIST FW command.\\nThe info-\u003edest_buf buffer is allocated based on the number of coredump\\nsegments returned by the FW.  The segment list is then DMA\u0027ed by\\nthe FW and the length of the DMA is returned by FW.  The driver then\\ncopies this DMA\u0027ed segment list to info-\u003edest_buf.\\n\\nIn some cases, this DMA length may exceed the info-\u003edest_buf length\\nand cause the above BUG condition.  Fix it by capping the copy\\nlength to not exceed the length of info-\u003edest_buf.  The extra\\nDMA data contains no useful information.\\n\\nThis code path is shared for the HWRM_DBG_COREDUMP_LIST and the\\nHWRM_DBG_COREDUMP_RETRIEVE FW commands.  The buffering is different\\nfor these 2 FW commands.  To simplify the logic, we need to move\\nthe line to adjust the buffer length for HWRM_DBG_COREDUMP_RETRIEVE\\nup, so that the new check to cap the copy length will work for both\\ncommands.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: bnxt_en: Se corrige memcpy() fuera de los l\u00edmite durante ethtool -w Al recuperar el volcado de n\u00facleo de FW con ethtool, a veces puede causar corrupci\u00f3n de memoria: ERROR: KFENCE: corrupci\u00f3n de memoria en __bnxt_get_coredump+0x3ef/0x670 [bnxt_en] Memoria corrupta en 0x000000008f0f30e8 [ ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ] (en kfence-#45): __bnxt_get_coredump+0x3ef/0x670 [bnxt_es] ethtool_get_dump_data+0xdc/0x1a0 __dev_ethtool+0xa1e/0x1af0 dev_ethtool+0xa8/0x170 dev_ioctl+0x1b5/0x580 sock_do_ioctl+0xab/0xf0 sock_ioctl+0x1ce/0x2e0 __x64_sys_ioctl+0x87/0xc0 do_syscall_64+0x5c/0xf0 entry_SYSCALL_64_after_hwframe+0x78/0x80 ... Esto sucede al copiar la lista de segmentos del volcado de n\u00facleo en bnxt_hwrm_dbg_dma_data() con el comando de firmware HWRM_DBG_COREDUMP_LIST. El b\u00fafer info-\u0026gt;dest_buf se asigna seg\u00fan la cantidad de segmentos de volcado de n\u00facleo devueltos por el firmware. El firmware procesa la lista de segmentos mediante DMA y devuelve su longitud. El controlador copia esta lista de segmentos procesada mediante DMA en info-\u0026gt;dest_buf. En algunos casos, esta longitud de DMA puede superar la longitud de info-\u0026gt;dest_buf y causar el error mencionado. Para solucionarlo, limite la longitud de la copia para que no supere la longitud de info-\u0026gt;dest_buf. Los datos DMA adicionales no contienen informaci\u00f3n \u00fatil. Esta ruta de c\u00f3digo es compartida por los comandos de firmware HWRM_DBG_COREDUMP_LIST y HWRM_DBG_COREDUMP_RETRIEVE. El almacenamiento en b\u00fafer es diferente para estos dos comandos de firmware. Para simplificar la l\u00f3gica, necesitamos mover la l\u00ednea para ajustar la longitud del b\u00fafer para HWRM_DBG_COREDUMP_RETRIEVE hacia arriba, de modo que la nueva verificaci\u00f3n para limitar la longitud de la copia funcione para ambos comandos.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/net/ethernet/broadcom/bnxt/bnxt_coredump.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"c74751f4c39232c31214ec6a3bc1c7e62f5c728b\",\"lessThan\":\"69b10dd23ab826d0c7f2d9ab311842251978d0c1\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"c74751f4c39232c31214ec6a3bc1c7e62f5c728b\",\"lessThan\":\"43292b83424158fa6ec458799f3cb9c54d18c484\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"c74751f4c39232c31214ec6a3bc1c7e62f5c728b\",\"lessThan\":\"4d69864915a3a052538e4ba76cd6fd77cfc64ebe\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"c74751f4c39232c31214ec6a3bc1c7e62f5c728b\",\"lessThan\":\"44807af79efd0d78fa36383dd865ddfe7992c0a6\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"c74751f4c39232c31214ec6a3bc1c7e62f5c728b\",\"lessThan\":\"44d81a9ebf0cad92512e0ffdf7412bfe20db66ec\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"c74751f4c39232c31214ec6a3bc1c7e62f5c728b\",\"lessThan\":\"6b87bd94f34370bbf1dfa59352bed8efab5bf419\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"4bf973a1f84aefb64750bdb3afe72d54de3199d7\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"a76837dd731b68cc3b5690470bc9efa2a8e3801a\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"4.19.95\",\"lessThan\":\"4.20\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"5.4.8\",\"lessThan\":\"5.5\",\"versionType\":\"semver\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/net/ethernet/broadcom/bnxt/bnxt_coredump.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"5.5\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"5.5\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.182\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.138\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.90\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.28\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.14.6\",\"lessThanOrEqual\":\"6.14.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.15\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-125\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.19.95\",\"versionEndExcluding\":\"4.20\",\"matchCriteriaId\":\"F8BA967D-44E8-4797-9C66-4A688373DA1C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.4.8\",\"versionEndExcluding\":\"5.5\",\"matchCriteriaId\":\"A1F70F25-EF24-41F5-84A3-EE6BF8BD9843\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.5.1\",\"versionEndExcluding\":\"5.15.182\",\"matchCriteriaId\":\"FCF2B8EB-AD17-4664-8C65-CBB793FE89DB\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.16\",\"versionEndExcluding\":\"6.1.138\",\"matchCriteriaId\":\"B6266F82-46B4-4D38-AC4A-54C92A1DFAB2\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.2\",\"versionEndExcluding\":\"6.6.90\",\"matchCriteriaId\":\"2BE1DB09-2D62-4C63-AF19-947300669741\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.12.28\",\"matchCriteriaId\":\"5082CE19-0F3D-4521-AB3E-810D8255F500\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.13\",\"versionEndExcluding\":\"6.14.6\",\"matchCriteriaId\":\"19E5095E-5950-43EA-8E78-FC860855293F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:5.5:-:*:*:*:*:*:*\",\"matchCriteriaId\":\"EE98F46A-F7D9-4609-B6A0-882E7F0D378C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:5.5:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"8C58602A-1D3D-4A07-AB88-AB5B403D3E8C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:5.5:rc4:*:*:*:*:*:*\",\"matchCriteriaId\":\"54191273-DBF7-4AF6-8039-36DFDEBF4529\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:5.5:rc5:*:*:*:*:*:*\",\"matchCriteriaId\":\"7A986E40-065E-4807-B171-802B9460E47E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:5.5:rc6:*:*:*:*:*:*\",\"matchCriteriaId\":\"911090B3-B2FF-4DD4-A4A4-1BEA41209886\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:5.5:rc7:*:*:*:*:*:*\",\"matchCriteriaId\":\"3444D854-CE07-4D25-827A-ECF7BB58EA2D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.15:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"8D465631-2980-487A-8E65-40AE2B9F8ED1\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.15:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"4C9D071F-B28E-46EC-AC61-22B913390211\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.15:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"13FC0DDE-E513-465E-9E81-515702D49B74\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.15:rc4:*:*:*:*:*:*\",\"matchCriteriaId\":\"8C7B5B0E-4EEB-48F5-B4CF-0935A7633845\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"FA6FEEC2-9F11-4643-8827-749718254FED\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/43292b83424158fa6ec458799f3cb9c54d18c484\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/44807af79efd0d78fa36383dd865ddfe7992c0a6\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/44d81a9ebf0cad92512e0ffdf7412bfe20db66ec\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/4d69864915a3a052538e4ba76cd6fd77cfc64ebe\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/69b10dd23ab826d0c7f2d9ab311842251978d0c1\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/6b87bd94f34370bbf1dfa59352bed8efab5bf419\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://lists.debian.org/debian-lts-announce/2025/08/msg00010.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Mailing List\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Low",
      "current_release_date": "2026-07-30T10:12:06+00:00",
      "cve": "CVE-2025-37911",
      "id": "CVE-2025-37911",
      "initial_release_date": "2025-05-20T00:00:00+00:00",
      "product_status:known_affected": "232",
      "product_status:known_not_affected": "42",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: bnxt_en: Fix out-of-bound memcpy() during ethtool -w",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-37911.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-07-16T18:45:15Z",
      "cve": "CVE-2025-37911",
      "id": "CVE-2025-37911",
      "initial_release_date": "2025-05-21T00:47:12Z",
      "product_status:known_affected": "623",
      "product_status:known_not_affected": "68",
      "product_status:recommended": "430",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2025-37911",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2025-37911.json",
      "version": "43"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.