CVE-2025-38439 (GCVE-0-2025-38439)

Vulnerability from cvelistv5 – Published: 2025-07-25 15:27 – Updated: 2026-08-05 12:01
VLAI
Title
bnxt_en: Set DMA unmap len correctly for XDP_REDIRECT
Summary
In the Linux kernel, the following vulnerability has been resolved: bnxt_en: Set DMA unmap len correctly for XDP_REDIRECT When transmitting an XDP_REDIRECT packet, call dma_unmap_len_set() with the proper length instead of 0. This bug triggers this warning on a system with IOMMU enabled: WARNING: CPU: 36 PID: 0 at drivers/iommu/dma-iommu.c:842 __iommu_dma_unmap+0x159/0x170 RIP: 0010:__iommu_dma_unmap+0x159/0x170 Code: a8 00 00 00 00 48 c7 45 b0 00 00 00 00 48 c7 45 c8 00 00 00 00 48 c7 45 a0 ff ff ff ff 4c 89 45 b8 4c 89 45 c0 e9 77 ff ff ff <0f> 0b e9 60 ff ff ff e8 8b bf 6a 00 66 66 2e 0f 1f 84 00 00 00 00 RSP: 0018:ff22d31181150c88 EFLAGS: 00010206 RAX: 0000000000002000 RBX: 00000000e13a0000 RCX: 0000000000000000 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 RBP: ff22d31181150cf0 R08: ff22d31181150ca8 R09: 0000000000000000 R10: 0000000000000000 R11: ff22d311d36c9d80 R12: 0000000000001000 R13: ff13544d10645010 R14: ff22d31181150c90 R15: ff13544d0b2bac00 FS: 0000000000000000(0000) GS:ff13550908a00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00005be909dacff8 CR3: 0008000173408003 CR4: 0000000000f71ef0 PKRU: 55555554 Call Trace: <IRQ> ? show_regs+0x6d/0x80 ? __warn+0x89/0x160 ? __iommu_dma_unmap+0x159/0x170 ? report_bug+0x17e/0x1b0 ? handle_bug+0x46/0x90 ? exc_invalid_op+0x18/0x80 ? asm_exc_invalid_op+0x1b/0x20 ? __iommu_dma_unmap+0x159/0x170 ? __iommu_dma_unmap+0xb3/0x170 iommu_dma_unmap_page+0x4f/0x100 dma_unmap_page_attrs+0x52/0x220 ? srso_alias_return_thunk+0x5/0xfbef5 ? xdp_return_frame+0x2e/0xd0 bnxt_tx_int_xdp+0xdf/0x440 [bnxt_en] __bnxt_poll_work_done+0x81/0x1e0 [bnxt_en] bnxt_poll+0xd3/0x1e0 [bnxt_en]
Severity
9.8 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: f18c2b77b2e4eec2313d519ba125bd6a069513cf , < e260f4d49370c85a4701d43c6d16b8c39f8b605f (git)
Affected: f18c2b77b2e4eec2313d519ba125bd6a069513cf , < 16ae306602163fcb7ae83f2701b542e43c100cee (git)
Affected: f18c2b77b2e4eec2313d519ba125bd6a069513cf , < 8d672a1a6bfc81fef9151925c9c0481f4acf4bec (git)
Affected: f18c2b77b2e4eec2313d519ba125bd6a069513cf , < f9eaf6d036075dc820520e1194692c0619b7297b (git)
Affected: f18c2b77b2e4eec2313d519ba125bd6a069513cf , < 5909679a82cd74cf0343d9e3ddf4b6931aa7e613 (git)
Affected: f18c2b77b2e4eec2313d519ba125bd6a069513cf , < f154e41e1d9d15ab21300ba7bbf0ebb5cb3b9c2a (git)
Affected: f18c2b77b2e4eec2313d519ba125bd6a069513cf , < 50dad9909715094e7d9ca25e9e0412b875987519 (git)
Affected: f18c2b77b2e4eec2313d519ba125bd6a069513cf , < 3cdf199d4755d477972ee87110b2aebc88b3cfad (git)
Create a notification for this product.
Linux Linux Affected: 5.3
Unaffected: 0 , < 5.3 (semver)
Unaffected: 5.4.296 , ≤ 5.4.* (semver)
Unaffected: 5.10.240 , ≤ 5.10.* (semver)
Unaffected: 5.15.189 , ≤ 5.15.* (semver)
Unaffected: 6.1.146 , ≤ 6.1.* (semver)
Unaffected: 6.6.99 , ≤ 6.6.* (semver)
Unaffected: 6.12.39 , ≤ 6.12.* (semver)
Unaffected: 6.15.7 , ≤ 6.15.* (semver)
Unaffected: 6.16 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T17:38:02.718Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html"
          },
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/broadcom/bnxt/bnxt_xdp.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "e260f4d49370c85a4701d43c6d16b8c39f8b605f",
              "status": "affected",
              "version": "f18c2b77b2e4eec2313d519ba125bd6a069513cf",
              "versionType": "git"
            },
            {
              "lessThan": "16ae306602163fcb7ae83f2701b542e43c100cee",
              "status": "affected",
              "version": "f18c2b77b2e4eec2313d519ba125bd6a069513cf",
              "versionType": "git"
            },
            {
              "lessThan": "8d672a1a6bfc81fef9151925c9c0481f4acf4bec",
              "status": "affected",
              "version": "f18c2b77b2e4eec2313d519ba125bd6a069513cf",
              "versionType": "git"
            },
            {
              "lessThan": "f9eaf6d036075dc820520e1194692c0619b7297b",
              "status": "affected",
              "version": "f18c2b77b2e4eec2313d519ba125bd6a069513cf",
              "versionType": "git"
            },
            {
              "lessThan": "5909679a82cd74cf0343d9e3ddf4b6931aa7e613",
              "status": "affected",
              "version": "f18c2b77b2e4eec2313d519ba125bd6a069513cf",
              "versionType": "git"
            },
            {
              "lessThan": "f154e41e1d9d15ab21300ba7bbf0ebb5cb3b9c2a",
              "status": "affected",
              "version": "f18c2b77b2e4eec2313d519ba125bd6a069513cf",
              "versionType": "git"
            },
            {
              "lessThan": "50dad9909715094e7d9ca25e9e0412b875987519",
              "status": "affected",
              "version": "f18c2b77b2e4eec2313d519ba125bd6a069513cf",
              "versionType": "git"
            },
            {
              "lessThan": "3cdf199d4755d477972ee87110b2aebc88b3cfad",
              "status": "affected",
              "version": "f18c2b77b2e4eec2313d519ba125bd6a069513cf",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/broadcom/bnxt/bnxt_xdp.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.3"
            },
            {
              "lessThan": "5.3",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.296",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.240",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.189",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.146",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.99",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.39",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.15.*",
              "status": "unaffected",
              "version": "6.15.7",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.16",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.296",
                  "versionStartIncluding": "5.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.240",
                  "versionStartIncluding": "5.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.189",
                  "versionStartIncluding": "5.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.146",
                  "versionStartIncluding": "5.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.99",
                  "versionStartIncluding": "5.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.39",
                  "versionStartIncluding": "5.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.15.7",
                  "versionStartIncluding": "5.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.16",
                  "versionStartIncluding": "5.3",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbnxt_en: Set DMA unmap len correctly for XDP_REDIRECT\n\nWhen transmitting an XDP_REDIRECT packet, call dma_unmap_len_set()\nwith the proper length instead of 0.  This bug triggers this warning\non a system with IOMMU enabled:\n\nWARNING: CPU: 36 PID: 0 at drivers/iommu/dma-iommu.c:842 __iommu_dma_unmap+0x159/0x170\nRIP: 0010:__iommu_dma_unmap+0x159/0x170\nCode: a8 00 00 00 00 48 c7 45 b0 00 00 00 00 48 c7 45 c8 00 00 00 00 48 c7 45 a0 ff ff ff ff 4c 89 45\nb8 4c 89 45 c0 e9 77 ff ff ff \u003c0f\u003e 0b e9 60 ff ff ff e8 8b bf 6a 00 66 66 2e 0f 1f 84 00 00 00 00\nRSP: 0018:ff22d31181150c88 EFLAGS: 00010206\nRAX: 0000000000002000 RBX: 00000000e13a0000 RCX: 0000000000000000\nRDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000\nRBP: ff22d31181150cf0 R08: ff22d31181150ca8 R09: 0000000000000000\nR10: 0000000000000000 R11: ff22d311d36c9d80 R12: 0000000000001000\nR13: ff13544d10645010 R14: ff22d31181150c90 R15: ff13544d0b2bac00\nFS: 0000000000000000(0000) GS:ff13550908a00000(0000) knlGS:0000000000000000\nCS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 00005be909dacff8 CR3: 0008000173408003 CR4: 0000000000f71ef0\nPKRU: 55555554\nCall Trace:\n\u003cIRQ\u003e\n? show_regs+0x6d/0x80\n? __warn+0x89/0x160\n? __iommu_dma_unmap+0x159/0x170\n? report_bug+0x17e/0x1b0\n? handle_bug+0x46/0x90\n? exc_invalid_op+0x18/0x80\n? asm_exc_invalid_op+0x1b/0x20\n? __iommu_dma_unmap+0x159/0x170\n? __iommu_dma_unmap+0xb3/0x170\niommu_dma_unmap_page+0x4f/0x100\ndma_unmap_page_attrs+0x52/0x220\n? srso_alias_return_thunk+0x5/0xfbef5\n? xdp_return_frame+0x2e/0xd0\nbnxt_tx_int_xdp+0xdf/0x440 [bnxt_en]\n__bnxt_poll_work_done+0x81/0x1e0 [bnxt_en]\nbnxt_poll+0xd3/0x1e0 [bnxt_en]"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The faulty unmap is reached purely by inbound network traffic \u2014 a received packet drives the XDP program to XDP_REDIRECT, `xdp_do_redirect()` \u2192 `bq_xmit_all()` \u2192 `bnxt_xdp_xmit()` \u2192 `__bnxt_xmit_xdp_redirect()`, with the corrupt `dma_unmap_len` consumed in `bnxt_tx_int_xdp()` on the NAPI completion. A remote attacker on the internet sending packets through an XDP-redirect load balancer/router built on a Broadcom NetXtreme NIC triggers it with no local access.\nAC:L - Once the (common datacenter) configuration of a bnxt_en NIC with an attached XDP program and IOMMU enabled is present, *every* redirected frame deterministically records `len = 0` and unmaps incorrectly \u2014 no race, no memory-layout grooming, no timing window is involved. The attacker simply sends traffic, and can send it at line rate to reproduce and to drive IOVA/page-table desynchronization.\nPR:N - The entire path from packet receive through `xdp_do_redirect()` to `bnxt_tx_int_xdp()` runs in softirq/NAPI context on behalf of an anonymous remote peer; there is no credential check, socket, or capability gate anywhere along it. The attacker needs no account or authentication on the target host.\nUI:N - No victim action is required \u2014 the redirect and the subsequent TX completion happen automatically in the driver\u0027s NAPI poll as soon as the attacker\u0027s packets arrive.\nS:U - The mis-sized DMA unmap, the leaked IOMMU translation, and the resulting corruption/disclosure all land in the host kernel\u0027s own memory and its own IOVA domain, within a single security authority. No VM, sandbox, or guest-to-host boundary is crossed, so scope is unchanged.\nC:H - Because `dma_unmap_single(len=0)` leaves the IOMMU translation in place (or removes only part of it) while `xdp_return_frame()` releases the page, and the mis-sized `free_iova_fast()` recycles that IOVA into the wrong size bin, a later `dma_map_single()` on the same IOVA collides with the surviving PTE \u2014 which Intel\u0027s `__domain_mapping()` retains while still returning success \u2014 so the NIC reads the previously freed, now-reallocated page and transmits arbitrary kernel/user memory onto the wire.\nI:H - The same IOVA-to-physical desynchronization means device DMA lands on physical pages the kernel has already freed and handed to other subsystems, with the surviving translation permitting access the kernel believes was revoked; combined with `switch_to_super_page()` promotion tearing down page tables covering neighbouring live mappings, this is a memory-corruption primitive whose content is attacker-supplied packet data.\nA:H - The bug reproducibly fires `WARN_ON(unmapped != size)` in `__iommu_dma_unmap()` from IRQ/NAPI context on every redirected frame \u2014 a per-packet splat that panics outright under `panic_on_warn` \u2014 and the under-sized IOVA frees progressively exhaust the device\u0027s IOVA space until `dma_map_single()` fails and the NIC stops forwarding traffic."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:01:55.025Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/e260f4d49370c85a4701d43c6d16b8c39f8b605f"
        },
        {
          "url": "https://git.kernel.org/stable/c/16ae306602163fcb7ae83f2701b542e43c100cee"
        },
        {
          "url": "https://git.kernel.org/stable/c/8d672a1a6bfc81fef9151925c9c0481f4acf4bec"
        },
        {
          "url": "https://git.kernel.org/stable/c/f9eaf6d036075dc820520e1194692c0619b7297b"
        },
        {
          "url": "https://git.kernel.org/stable/c/5909679a82cd74cf0343d9e3ddf4b6931aa7e613"
        },
        {
          "url": "https://git.kernel.org/stable/c/f154e41e1d9d15ab21300ba7bbf0ebb5cb3b9c2a"
        },
        {
          "url": "https://git.kernel.org/stable/c/50dad9909715094e7d9ca25e9e0412b875987519"
        },
        {
          "url": "https://git.kernel.org/stable/c/3cdf199d4755d477972ee87110b2aebc88b3cfad"
        }
      ],
      "title": "bnxt_en: Set DMA unmap len correctly for XDP_REDIRECT",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-38439",
    "datePublished": "2025-07-25T15:27:18.640Z",
    "dateReserved": "2025-04-16T04:51:24.016Z",
    "dateUpdated": "2026-08-05T12:01:55.025Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-38439",
      "date": "2026-08-05",
      "epss": "0.00481",
      "percentile": "0.38941"
    },
    "microsoft_vex": {
      "current_release_date": "2026-02-24T14:38:21.000Z",
      "cve": "CVE-2025-38439",
      "id": "msrc_CVE-2025-38439",
      "initial_release_date": "2025-07-02T00:00:00.000Z",
      "product_status:fixed": "2",
      "product_status:known_affected": "3",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "bnxt_en: Set DMA unmap len correctly for XDP_REDIRECT",
      "url": "https://msrc.microsoft.com/csaf/vex/2025/msrc_cve-2025-38439.json",
      "version": "3"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-38439\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-07-25T16:15:29.257\",\"lastModified\":\"2026-07-30T06:23:14.407\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nbnxt_en: Set DMA unmap len correctly for XDP_REDIRECT\\n\\nWhen transmitting an XDP_REDIRECT packet, call dma_unmap_len_set()\\nwith the proper length instead of 0.  This bug triggers this warning\\non a system with IOMMU enabled:\\n\\nWARNING: CPU: 36 PID: 0 at drivers/iommu/dma-iommu.c:842 __iommu_dma_unmap+0x159/0x170\\nRIP: 0010:__iommu_dma_unmap+0x159/0x170\\nCode: a8 00 00 00 00 48 c7 45 b0 00 00 00 00 48 c7 45 c8 00 00 00 00 48 c7 45 a0 ff ff ff ff 4c 89 45\\nb8 4c 89 45 c0 e9 77 ff ff ff \u003c0f\u003e 0b e9 60 ff ff ff e8 8b bf 6a 00 66 66 2e 0f 1f 84 00 00 00 00\\nRSP: 0018:ff22d31181150c88 EFLAGS: 00010206\\nRAX: 0000000000002000 RBX: 00000000e13a0000 RCX: 0000000000000000\\nRDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000\\nRBP: ff22d31181150cf0 R08: ff22d31181150ca8 R09: 0000000000000000\\nR10: 0000000000000000 R11: ff22d311d36c9d80 R12: 0000000000001000\\nR13: ff13544d10645010 R14: ff22d31181150c90 R15: ff13544d0b2bac00\\nFS: 0000000000000000(0000) GS:ff13550908a00000(0000) knlGS:0000000000000000\\nCS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\\nCR2: 00005be909dacff8 CR3: 0008000173408003 CR4: 0000000000f71ef0\\nPKRU: 55555554\\nCall Trace:\\n\u003cIRQ\u003e\\n? show_regs+0x6d/0x80\\n? __warn+0x89/0x160\\n? __iommu_dma_unmap+0x159/0x170\\n? report_bug+0x17e/0x1b0\\n? handle_bug+0x46/0x90\\n? exc_invalid_op+0x18/0x80\\n? asm_exc_invalid_op+0x1b/0x20\\n? __iommu_dma_unmap+0x159/0x170\\n? __iommu_dma_unmap+0xb3/0x170\\niommu_dma_unmap_page+0x4f/0x100\\ndma_unmap_page_attrs+0x52/0x220\\n? srso_alias_return_thunk+0x5/0xfbef5\\n? xdp_return_frame+0x2e/0xd0\\nbnxt_tx_int_xdp+0xdf/0x440 [bnxt_en]\\n__bnxt_poll_work_done+0x81/0x1e0 [bnxt_en]\\nbnxt_poll+0xd3/0x1e0 [bnxt_en]\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: bnxt_en: Establezca la longitud de desasignaci\u00f3n de DMA correctamente para XDP_REDIRECT. Al transmitir un paquete XDP_REDIRECT, llame a dma_unmap_len_set() con la longitud adecuada en lugar de 0. Este error activa esta advertencia en un sistema con IOMMU habilitado: WARNING: CPU: 36 PID: 0 at drivers/iommu/dma-iommu.c:842 __iommu_dma_unmap+0x159/0x170 RIP: 0010:__iommu_dma_unmap+0x159/0x170 Code: a8 00 00 00 00 48 c7 45 b0 00 00 00 00 48 c7 45 c8 00 00 00 00 48 c7 45 a0 ff ff ff ff 4c 89 45 b8 4c 89 45 c0 e9 77 ff ff ff \u0026lt;0f\u0026gt; 0b e9 60 ff ff ff e8 8b bf 6a 00 66 66 2e 0f 1f 84 00 00 00 00 RSP: 0018:ff22d31181150c88 EFLAGS: 00010206 RAX: 0000000000002000 RBX: 00000000e13a0000 RCX: 0000000000000000 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 RBP: ff22d31181150cf0 R08: ff22d31181150ca8 R09: 0000000000000000 R10: 0000000000000000 R11: ff22d311d36c9d80 R12: 0000000000001000 R13: ff13544d10645010 R14: ff22d31181150c90 R15: ff13544d0b2bac00 FS: 0000000000000000(0000) GS:ff13550908a00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00005be909dacff8 CR3: 0008000173408003 CR4: 0000000000f71ef0 PKRU: 55555554 Call Trace:  ? show_regs+0x6d/0x80 ? __warn+0x89/0x160 ? __iommu_dma_unmap+0x159/0x170 ? report_bug+0x17e/0x1b0 ? handle_bug+0x46/0x90 ? exc_invalid_op+0x18/0x80 ? asm_exc_invalid_op+0x1b/0x20 ? __iommu_dma_unmap+0x159/0x170 ? __iommu_dma_unmap+0xb3/0x170 iommu_dma_unmap_page+0x4f/0x100 dma_unmap_page_attrs+0x52/0x220 ? srso_alias_return_thunk+0x5/0xfbef5 ? xdp_return_frame+0x2e/0xd0 bnxt_tx_int_xdp+0xdf/0x440 [bnxt_en] __bnxt_poll_work_done+0x81/0x1e0 [bnxt_en] bnxt_poll+0xd3/0x1e0 [bnxt_en]\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/net/ethernet/broadcom/bnxt/bnxt_xdp.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"f18c2b77b2e4eec2313d519ba125bd6a069513cf\",\"lessThan\":\"e260f4d49370c85a4701d43c6d16b8c39f8b605f\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"f18c2b77b2e4eec2313d519ba125bd6a069513cf\",\"lessThan\":\"16ae306602163fcb7ae83f2701b542e43c100cee\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"f18c2b77b2e4eec2313d519ba125bd6a069513cf\",\"lessThan\":\"8d672a1a6bfc81fef9151925c9c0481f4acf4bec\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"f18c2b77b2e4eec2313d519ba125bd6a069513cf\",\"lessThan\":\"f9eaf6d036075dc820520e1194692c0619b7297b\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"f18c2b77b2e4eec2313d519ba125bd6a069513cf\",\"lessThan\":\"5909679a82cd74cf0343d9e3ddf4b6931aa7e613\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"f18c2b77b2e4eec2313d519ba125bd6a069513cf\",\"lessThan\":\"f154e41e1d9d15ab21300ba7bbf0ebb5cb3b9c2a\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"f18c2b77b2e4eec2313d519ba125bd6a069513cf\",\"lessThan\":\"50dad9909715094e7d9ca25e9e0412b875987519\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"f18c2b77b2e4eec2313d519ba125bd6a069513cf\",\"lessThan\":\"3cdf199d4755d477972ee87110b2aebc88b3cfad\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/net/ethernet/broadcom/bnxt/bnxt_xdp.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"5.3\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"5.3\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.4.296\",\"lessThanOrEqual\":\"5.4.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.10.240\",\"lessThanOrEqual\":\"5.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.189\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.146\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.99\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.39\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.15.7\",\"lessThanOrEqual\":\"6.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.16\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":9.8,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":5.9},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"NVD-CWE-noinfo\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.3\",\"versionEndExcluding\":\"5.4.296\",\"matchCriteriaId\":\"84CBC3C6-3C2C-4ED5-9AE6-91D18F68467E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.5\",\"versionEndExcluding\":\"5.10.240\",\"matchCriteriaId\":\"0E73A49A-F9B2-470F-91B2-6FAB6239BDB6\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.11\",\"versionEndExcluding\":\"5.15.189\",\"matchCriteriaId\":\"3CE0FB9A-DBE8-48B6-BF6E-3C724A4991E3\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.16\",\"versionEndExcluding\":\"6.1.146\",\"matchCriteriaId\":\"D8DA1166-5C95-475E-BF65-1DF621968E96\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.2\",\"versionEndExcluding\":\"6.6.99\",\"matchCriteriaId\":\"B369699C-E0E6-42A4-BDEE-8E676ECEF6AA\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.12.39\",\"matchCriteriaId\":\"18D57670-11F8-4B5A-AD56-EA32DD0F44E1\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.13\",\"versionEndExcluding\":\"6.15.7\",\"matchCriteriaId\":\"F9C46937-5FA9-4335-AD7B-E7FC29453CE1\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.16:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"6D4894DB-CCFE-4602-B1BF-3960B2E19A01\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.16:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"09709862-E348-4378-8632-5A7813EDDC86\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.16:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"415BF58A-8197-43F5-B3D7-D1D63057A26E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.16:rc4:*:*:*:*:*:*\",\"matchCriteriaId\":\"A0517869-312D-4429-80C2-561086E1421C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.16:rc5:*:*:*:*:*:*\",\"matchCriteriaId\":\"85421F4E-C863-4ABF-B4B4-E887CC2F7F92\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"FA6FEEC2-9F11-4643-8827-749718254FED\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/16ae306602163fcb7ae83f2701b542e43c100cee\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/3cdf199d4755d477972ee87110b2aebc88b3cfad\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/50dad9909715094e7d9ca25e9e0412b875987519\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/5909679a82cd74cf0343d9e3ddf4b6931aa7e613\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/8d672a1a6bfc81fef9151925c9c0481f4acf4bec\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/e260f4d49370c85a4701d43c6d16b8c39f8b605f\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/f154e41e1d9d15ab21300ba7bbf0ebb5cb3b9c2a\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/f9eaf6d036075dc820520e1194692c0619b7297b\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-07-30T09:07:35+00:00",
      "cve": "CVE-2025-38439",
      "id": "CVE-2025-38439",
      "initial_release_date": "2025-07-25T00:00:00+00:00",
      "product_status:known_affected": "232",
      "product_status:known_not_affected": "42",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: bnxt_en: Set DMA unmap len correctly for XDP_REDIRECT",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-38439.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "low",
      "current_release_date": "2026-07-19T17:49:31Z",
      "cve": "CVE-2025-38439",
      "id": "CVE-2025-38439",
      "initial_release_date": "2025-07-25T23:23:02Z",
      "product_status:first_fixed": "2",
      "product_status:known_affected": "651",
      "product_status:known_not_affected": "97",
      "product_status:recommended": "508",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2025-38439",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2025-38439.json",
      "version": "55"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.