Description
In the Linux kernel, the following vulnerability has been resolved:
bnxt_en: Fix receive ring space parameters when XDP is active
The MTU setting at the time an XDP multi-buffer is attached
determines whether the aggregation ring will be used and the
rx_skb_func handler. This is done in bnxt_set_rx_skb_mode().
If the MTU is later changed, the aggregation ring setting may need
to be changed and it may become out-of-sync with the settings
initially done in bnxt_set_rx_skb_mode(). This may result in
random memory corruption and crashes as the HW may DMA data larger
than the allocated buffer size, such as:
BUG: kernel NULL pointer dereference, address: 00000000000003c0
PGD 0 P4D 0
Oops: 0000 [#1] PREEMPT SMP NOPTI
CPU: 17 PID: 0 Comm: swapper/17 Kdump: loaded Tainted: G S OE 6.1.0-226bf9805506 #1
Hardware name: Wiwynn Delta Lake PVT BZA.02601.0150/Delta Lake-Class1, BIOS F0E_3A12 08/26/2021
RIP: 0010:bnxt_rx_pkt+0xe97/0x1ae0 [bnxt_en]
Code: 8b 95 70 ff ff ff 4c 8b 9d 48 ff ff ff 66 41 89 87 b4 00 00 00 e9 0b f7 ff ff 0f b7 43 0a 49 8b 95 a8 04 00 00 25 ff 0f 00 00 <0f> b7 14 42 48 c1 e2 06 49 03 95 a0 04 00 00 0f b6 42 33f
RSP: 0018:ffffa19f40cc0d18 EFLAGS: 00010202
RAX: 00000000000001e0 RBX: ffff8e2c805c6100 RCX: 00000000000007ff
RDX: 0000000000000000 RSI: ffff8e2c271ab990 RDI: ffff8e2c84f12380
RBP: ffffa19f40cc0e48 R08: 000000000001000d R09: 974ea2fcddfa4cbf
R10: 0000000000000000 R11: ffffa19f40cc0ff8 R12: ffff8e2c94b58980
R13: ffff8e2c952d6600 R14: 0000000000000016 R15: ffff8e2c271ab990
FS: 0000000000000000(0000) GS:ffff8e3b3f840000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00000000000003c0 CR3: 0000000e8580a004 CR4: 00000000007706e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
PKRU: 55555554
Call Trace:
<IRQ>
__bnxt_poll_work+0x1c2/0x3e0 [bnxt_en]
To address the issue, we now call bnxt_set_rx_skb_mode() within
bnxt_change_mtu() to properly set the AGG rings configuration and
update rx_skb_func based on the new MTU value.
Additionally, BNXT_FLAG_NO_AGG_RINGS is cleared at the beginning of
bnxt_set_rx_skb_mode() to make sure it gets set or cleared based on
the current MTU.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Linux | Linux | 6.1.45 – < 6.1.140, 6.4.10 – < 6.5, 6.5 | 6.1.140 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | linux | 6.12.3-1 | — |
| Debian 13 | linux | 6.12.3-1 | — |
| Debian 12 | linux | 6.1.140-1 | DSA-5925-1 |
| Debian 11 | linux-6.1 | 6.1.140-1~deb11u1 | DLA-4271-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 24.04 LTS | linux | 6.8.0-58.60 | USN-7449-1 |
| Ubuntu 24.04 LTS | linux-aws | 6.8.0-1027.29 | USN-7449-1 |
| Ubuntu 24.04 LTS | linux-azure | 6.8.0-1027.32 | USN-7449-1 |
| Ubuntu 24.04 LTS | linux-azure-6.11 | 6.11.0-1012.12~24.04.1 | — |
| Ubuntu 24.04 LTS | linux-azure-nvidia | 6.8.0-1014.15 | USN-7468-1 |
| Ubuntu 24.04 LTS | linux-gcp | 6.8.0-1028.30 | USN-7450-1 |
| Ubuntu 24.04 LTS | linux-gcp-6.11 | 6.11.0-1011.11~24.04.1 | — |
| Ubuntu 24.04 LTS | linux-gke | 6.8.0-1023.27 | USN-7450-1 |
| Ubuntu 24.04 LTS | linux-gkeop | 6.8.0-1010.12 | USN-7450-1 |
| Ubuntu 24.04 LTS | linux-ibm | 6.8.0-1024.24 | USN-7449-1 |
| Ubuntu 24.04 LTS | linux-nvidia | 6.8.0-1026.29 | USN-7449-1 |
| Ubuntu 24.04 LTS | linux-nvidia-6.11 | 6.11.0-1007.7 | — |
| Ubuntu 24.04 LTS | linux-nvidia-lowlatency | 6.8.0-1026.29.1 | USN-7449-1 |
| Ubuntu 24.04 LTS | linux-nvidia-tegra | 6.8.0-1008.8 | — |
| Ubuntu 24.04 LTS | linux-oem-6.11 | 6.11.0-1015.15 | USN-7310-1 |
| Ubuntu 24.04 LTS | linux-oem-6.8 | 6.8.0-1026.26 | USN-7449-1 |
| Ubuntu 24.04 LTS | linux-oracle | 6.8.0-1024.25 | USN-7449-1 |
| Ubuntu 24.04 LTS | linux-raspi | 6.8.0-1028.32 | USN-7524-1 |
| Ubuntu 24.04 LTS | linux-realtime +1 | No fix yet | — |
| Ubuntu 24.04 LTS | linux-riscv +1 | 6.8.0-58.60.1 | USN-7449-1 |
| Ubuntu 24.04 LTS | linux-xilinx | 6.8.0-1017.18 | — |
| Ubuntu 22.04 LTS | linux-aws-6.8 | 6.8.0-1027.29~22.04.1 | USN-7451-1 |
| Ubuntu 22.04 LTS | linux-azure-6.8 | 6.8.0-1027.32~22.04.1 | USN-7449-1 |
| Ubuntu 22.04 LTS | linux-gcp-6.8 | 6.8.0-1028.30~22.04.1 | USN-7452-1 |
| Ubuntu 22.04 LTS | linux-hwe-6.8 | 6.8.0-58.60~22.04.1 | USN-7449-2 |
| Ubuntu 22.04 LTS | linux-ibm-6.8 | 6.8.0-1024.24~22.04.1 | — |
| Ubuntu 22.04 LTS | linux-nvidia-6.8 | 6.8.0-1026.29~22.04.1 | USN-7449-1 |
| Ubuntu 22.04 LTS | linux-oracle-6.8 | 6.8.0-1024.25~22.04.1 | USN-7449-1 |
| Ubuntu 22.04 LTS | linux-riscv +32 | No fix yet | — |
| Ubuntu 22.04 LTS | linux-riscv-6.8 +1 | 6.8.0-58.60.1~22.04.1 | USN-7449-1 |
| Ubuntu 20.04 LTS | linux-gke +28 | No fix yet | — |
| Ubuntu 18.04 LTS | linux-gcp +14 | No fix yet | — |
| Ubuntu 16.04 LTS | linux-hwe-edge | No fix yet | — |
Show 3 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro Realtime 24.04 LTS | linux-raspi-realtime | 6.8.0-2023.24 | USN-7523-1 |
| Ubuntu Pro Realtime 24.04 LTS | linux-realtime | 6.8.1-1020.21 | USN-7453-1 |
| Ubuntu Pro Realtime 22.04 LTS | linux-realtime-6.8 | 6.8.1-1020.21~22.04.1 | — |
| Ubuntu Pro FIPS-updates 24.04 LTS | linux-fips | 6.8.0-78.78+fips1 | — |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP6 | kernel-64kb +6 | 6.4.0-150600.23.33.1 | SUSE-SU-2025:0154-1 |
| SLES 15 SP6 | kernel-azure +2 | 6.4.0-150600.8.23.1 | SUSE-SU-2025:0117-1 |
| SLES 15 SP6 | kernel-coco +3 | 6.4.0-15061.12.coco15sp6.1 | SUSE-SU-2025:0289-1 |
| SLES 15 SP6 | kernel-default-base | 6.4.0-150600.23.33.1.150600.12.14.1 | SUSE-SU-2025:0154-1 |
| SLES 15 SP5 | kernel-64kb +6 | 5.14.21-150500.55.94.1 | SUSE-SU-2025:0577-2, SUSE-SU-2025:0577-1 |
| SLES 15 SP5 | kernel-default-base | 5.14.21-150500.55.94.1.150500.6.43.1 | SUSE-SU-2025:0577-2, SUSE-SU-2025:0577-1 |
Show 8 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES for SAP 15 SP5 | kernel-default-base | 5.14.21-150500.55.94.1.150500.6.43.1 | SUSE-SU-2025:0577-2, SUSE-SU-2025:0577-1 |
| SLES for SAP 15 SP5 | kernel-docs +4 | 5.14.21-150500.55.94.1 | SUSE-SU-2025:0577-2, SUSE-SU-2025:0577-1 |
| SLE Micro 6.1 | kernel-default-base | 6.4.0-24.1.21.4 | SUSE-SU-2025:20248-1 |
| SLE Micro 6.1 | kernel-livepatch-MICRO-6-0-RT_Update_5 | 1-1.1 | SUSE-SU-2025:20249-1 |
| SLE Micro 6.1 | kernel-livepatch-MICRO-6-0_Update_5 | 1-1.2 | SUSE-SU-2025:20248-1 |
| SLE Micro 6.1 | kernel-rt +4 | 6.4.0-25.1 | SUSE-SU-2025:20249-1, SUSE-SU-2025:20248-1 |
| SLE Micro 6.0 | kernel-default-base | 6.4.0-24.1.21.4 | SUSE-SU-2025:20165-1 |
| SLE Micro 6.0 | kernel-livepatch-MICRO-6-0-RT_Update_5 | 1-1.1 | SUSE-SU-2025:20166-1 |
| SLE Micro 6.0 | kernel-livepatch-MICRO-6-0_Update_5 | 1-1.2 | SUSE-SU-2025:20165-1 |
| SLE Micro 6.0 | kernel-rt +4 | 6.4.0-25.1 | SUSE-SU-2025:20166-1, SUSE-SU-2025:20165-1 |
| SLE Micro 5.5 | kernel-default-base | 5.14.21-150500.55.94.1.150500.6.43.1 | SUSE-SU-2025:0577-2, SUSE-SU-2025:0577-1 |
| SLE Micro 5.5 | kernel-rt +1 | 5.14.21-150500.13.85.1 | SUSE-SU-2025:0556-1 |
| SLE Micro 5.5 | kernel-source +1 | 5.14.21-150500.55.94.1 | SUSE-SU-2025:0577-2, SUSE-SU-2025:0577-1 |
| SLE Live Patching 15 SP6 | kernel-default | 6.4.0-150600.23.33.1 | SUSE-SU-2025:0154-1 |
| SLE Live Patching 15 SP6 | kernel-livepatch-SLE15-SP6-RT_Update_7 | 1-150600.1.3.1 | SUSE-SU-2025:0153-1 |
| SLE Live Patching 15 SP6 | kernel-livepatch-SLE15-SP6_Update_7 | 1-150600.13.3.1 | SUSE-SU-2025:0154-1 |
| SLE Live Patching 15 SP5 | kernel-default | 5.14.21-150500.55.94.1 | SUSE-SU-2025:0577-1 |
| SLE Live Patching 15 SP5 | kernel-livepatch-SLE15-SP5_Update_23 | 1-150500.11.3.1 | SUSE-SU-2025:0577-1 |
| SLE HPC 15 SP5 | kernel-64kb +5 | 5.14.21-150500.55.94.1 | SUSE-SU-2025:0577-2, SUSE-SU-2025:0577-1 |
| SLE HPC 15 SP5 | kernel-default-base | 5.14.21-150500.55.94.1.150500.6.43.1 | SUSE-SU-2025:0577-2, SUSE-SU-2025:0577-1 |
| SUSE Real Time Module 15 SP6 | kernel-rt +3 | 6.4.0-150600.10.23.1 | SUSE-SU-2025:0153-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Leap 15.6 | dtb-aarch64 +10 | 6.4.0-150600.23.33.1 | SUSE-SU-2025:0154-1 |
| openSUSE Leap 15.6 | kernel-azure +2 | 6.4.0-150600.8.23.1 | SUSE-SU-2025:0117-1 |
| openSUSE Leap 15.6 | kernel-default-base | 6.4.0-150600.23.33.1.150600.12.14.1 | SUSE-SU-2025:0154-1 |
| openSUSE Leap 15.6 | kernel-rt +3 | 6.4.0-150600.10.23.1 | SUSE-SU-2025:0153-1 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | kernel | 6.6.85.1-1 | — |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 9 | kernel-uek +34 | 6.12.0-101.33.4.3.el10uek | ELSA-2025-20530, ELSA-2025-20480 |
| Oracle Linux 8 | bpftool +17 | 5.15.0-307.178.5.el9uek | ELSA-2025-20270 |
Advisories 27
- WID-SEC-2024-3762 Linux Kernel: Mehrere Schwachstellen ermöglichen Denial of Service BSI CERT-Bund (WID) · Nov 10, 2026
- USN-7449-1 linux, linux-aws, linux-azure, linux-azure-6.8, linux-ibm, linux-lowlatency, linux-lowlatency-hwe-6.8, linux-nvidia, linux-nvidia-6.8, linux-nvidia-lowlatency, linux-oem-6.8, linux-oracle, linux-oracle-6.8 vulnerabilities Ubuntu Security Notices (USN) · Nov 3, 2026
- USN-7450-1 linux-gcp, linux-gke, linux-gkeop vulnerabilities Ubuntu Security Notices (USN) · Nov 3, 2026
- USN-7468-1 linux-azure-nvidia vulnerabilities Ubuntu Security Notices (USN) · Nov 3, 2026
- USN-7453-1 linux-realtime vulnerabilities Ubuntu Security Notices (USN) · Nov 3, 2026
- USN-7451-1 linux-aws-6.8 vulnerabilities Ubuntu Security Notices (USN) · Nov 3, 2026
- USN-7524-1 linux-raspi vulnerabilities Ubuntu Security Notices (USN) · Nov 3, 2026
- USN-7523-1 linux-raspi-realtime vulnerabilities Ubuntu Security Notices (USN) · Nov 3, 2026
- USN-7310-1 linux-oem-6.11 vulnerabilities Ubuntu Security Notices (USN) · Nov 3, 2026
- USN-7452-1 linux-gcp-6.8 vulnerabilities Ubuntu Security Notices (USN) · Nov 3, 2026
- USN-7449-2 linux-hwe-6.8 vulnerabilities Ubuntu Security Notices (USN) · Nov 3, 2026
- SUSE-SU-2025:20165-1 Security update for the Linux Kernel SUSE / openSUSE Security Updates · Mar 23, 2026
- SUSE-SU-2025:20166-1 Security update for the Linux Kernel SUSE / openSUSE Security Updates · Mar 23, 2026
- SUSE-SU-2025:20249-1 Security update for the Linux Kernel SUSE / openSUSE Security Updates · Mar 23, 2026
- SUSE-SU-2025:20248-1 Security update for the Linux Kernel SUSE / openSUSE Security Updates · Mar 23, 2026
- DLA-4271-1 linux-6.1 - security update Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-5925-1 linux - security update Debian Security (DSA / DLA) · Mar 9, 2026
- SUSE-SU-2025:0117-1 Security update for the Linux Kernel SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2025:0153-1 Security update for the Linux Kernel SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2025:0154-1 Security update for the Linux Kernel SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2025:0556-1 Security update for the Linux Kernel SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2025:0577-2 Security update for the Linux Kernel SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2025:0577-1 Security update for the Linux Kernel SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2025:0289-1 Security update for the Linux Kernel SUSE / openSUSE Security Updates · Feb 4, 2026
- ELSA-2025-20530 Important: Unbreakable Enterprise kernel security update (Oracle Linux 9) Oracle Linux Security Advisories (ELSA) · Aug 18, 2025
- ELSA-2025-20480 Important: Unbreakable Enterprise kernel security update (Oracle Linux 9) Oracle Linux Security Advisories (ELSA) · Jul 17, 2025
- ELSA-2025-20270 Important: Unbreakable Enterprise kernel security update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · Apr 11, 2025
References
- https://git.kernel.org/stable/c/b7fd784d7c6a1bd927a23e0d06f09a776ee3889b
- https://git.kernel.org/stable/c/7f306c651feab2f3689185f60b94e72b573255db
- https://git.kernel.org/stable/c/bf54a7660fc8d2166f41ff1d67a643b15d8b2250
- https://git.kernel.org/stable/c/84353386762a0a16dd444ead76c012e167d89b41
- https://git.kernel.org/stable/c/3051a77a09dfe3022aa012071346937fdf059033