GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2025-21682 (GCVE-0-2025-21682)

Vulnerability from cvelistv5 – Published: 2025-01-31 11:25 – Updated: 2026-09-08 08:40
VLAI
Title
eth: bnxt: always recalculate features after XDP clearing, fix null-deref
Summary
In the Linux kernel, the following vulnerability has been resolved: eth: bnxt: always recalculate features after XDP clearing, fix null-deref Recalculate features when XDP is detached. Before: # ip li set dev eth0 xdp obj xdp_dummy.bpf.o sec xdp # ip li set dev eth0 xdp off # ethtool -k eth0 | grep gro rx-gro-hw: off [requested on] After: # ip li set dev eth0 xdp obj xdp_dummy.bpf.o sec xdp # ip li set dev eth0 xdp off # ethtool -k eth0 | grep gro rx-gro-hw: on The fact that HW-GRO doesn't get re-enabled automatically is just a minor annoyance. The real issue is that the features will randomly come back during another reconfiguration which just happens to invoke netdev_update_features(). The driver doesn't handle reconfiguring two things at a time very robustly. Starting with commit 98ba1d931f61 ("bnxt_en: Fix RSS logic in __bnxt_reserve_rings()") we only reconfigure the RSS hash table if the "effective" number of Rx rings has changed. If HW-GRO is enabled "effective" number of rings is 2x what user sees. So if we are in the bad state, with HW-GRO re-enablement "pending" after XDP off, and we lower the rings by / 2 - the HW-GRO rings doing 2x and the ethtool -L doing / 2 may cancel each other out, and the: if (old_rx_rings != bp->hw_resc.resv_rx_rings && condition in __bnxt_reserve_rings() will be false. The RSS map won't get updated, and we'll crash with: BUG: kernel NULL pointer dereference, address: 0000000000000168 RIP: 0010:__bnxt_hwrm_vnic_set_rss+0x13a/0x1a0 bnxt_hwrm_vnic_rss_cfg_p5+0x47/0x180 __bnxt_setup_vnic_p5+0x58/0x110 bnxt_init_nic+0xb72/0xf50 __bnxt_open_nic+0x40d/0xab0 bnxt_open_nic+0x2b/0x60 ethtool_set_channels+0x18c/0x1d0 As we try to access a freed ring. The issue is present since XDP support was added, really, but prior to commit 98ba1d931f61 ("bnxt_en: Fix RSS logic in __bnxt_reserve_rings()") it wasn't causing major issues.
Severity
7.3 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H
5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-10-01 19:51 UTC
CWE
  • CWE-476 - NULL Pointer Dereference
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 1054aee82321483dceabbb9b9e5d6512e8fe684b , < 076a694a42ae3f0466bc6e4126050eeb7b7d299a (git)
Affected: 1054aee82321483dceabbb9b9e5d6512e8fe684b , < 90336fc3d6f5e716ac39a9ddbbde453e23a5aa65 (git)
Affected: 1054aee82321483dceabbb9b9e5d6512e8fe684b , < 08831a894d18abfaabb5bbde7c2069a7fb41dd93 (git)
Affected: 1054aee82321483dceabbb9b9e5d6512e8fe684b , < f0aa6a37a3dbb40b272df5fc6db93c114688adcd (git)
guessed Create a notification for this product.
Linux Linux Affected: 4.16
Unaffected: 0 , < 4.16 (semver)
Unaffected: 6.1.167 , ≤ 6.1.* (semver)
Unaffected: 6.6.130 , ≤ 6.6.* (semver)
Unaffected: 6.12.11 , ≤ 6.12.* (semver)
Unaffected: 6.13 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP Affected: V3.1.6 , < * (custom)
guessed Create a notification for this product.
Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP Affected: V3.1.5 , < * (custom)
guessed Create a notification for this product.
Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP Affected: V3.1.6 , < * (custom)
guessed Create a notification for this product.
Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP Affected: V3.1.5 , < * (custom)
guessed Create a notification for this product.
Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP Affected: V3.1.6 , < * (custom)
guessed Create a notification for this product.
Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP Affected: V3.1.5 , < * (custom)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 5.5,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2025-21682",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-10-01T19:51:50.706963Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-476",
                "description": "CWE-476 NULL Pointer Dereference",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-10-01T19:57:11.247Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "affected": [
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.5",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.5",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.5",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.5",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.5",
                "versionType": "custom"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-08T08:40:17.844Z",
          "orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
          "shortName": "siemens-SADP"
        },
        "references": [
          {
            "url": "https://cert-portal.siemens.com/productcert/html/ssa-082556.html"
          },
          {
            "url": "https://cert-portal.siemens.com/productcert/html/ssa-019113.html"
          }
        ],
        "x_adpType": "supplier"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/broadcom/bnxt/bnxt.c",
            "drivers/net/ethernet/broadcom/bnxt/bnxt.h",
            "drivers/net/ethernet/broadcom/bnxt/bnxt_xdp.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "076a694a42ae3f0466bc6e4126050eeb7b7d299a",
              "status": "affected",
              "version": "1054aee82321483dceabbb9b9e5d6512e8fe684b",
              "versionType": "git"
            },
            {
              "lessThan": "90336fc3d6f5e716ac39a9ddbbde453e23a5aa65",
              "status": "affected",
              "version": "1054aee82321483dceabbb9b9e5d6512e8fe684b",
              "versionType": "git"
            },
            {
              "lessThan": "08831a894d18abfaabb5bbde7c2069a7fb41dd93",
              "status": "affected",
              "version": "1054aee82321483dceabbb9b9e5d6512e8fe684b",
              "versionType": "git"
            },
            {
              "lessThan": "f0aa6a37a3dbb40b272df5fc6db93c114688adcd",
              "status": "affected",
              "version": "1054aee82321483dceabbb9b9e5d6512e8fe684b",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/broadcom/bnxt/bnxt.c",
            "drivers/net/ethernet/broadcom/bnxt/bnxt.h",
            "drivers/net/ethernet/broadcom/bnxt/bnxt_xdp.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.16"
            },
            {
              "lessThan": "4.16",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.167",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.130",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.11",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.13",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.167",
                  "versionStartIncluding": "4.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.130",
                  "versionStartIncluding": "4.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.11",
                  "versionStartIncluding": "4.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.13",
                  "versionStartIncluding": "4.16",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\neth: bnxt: always recalculate features after XDP clearing, fix null-deref\n\nRecalculate features when XDP is detached.\n\nBefore:\n  # ip li set dev eth0 xdp obj xdp_dummy.bpf.o sec xdp\n  # ip li set dev eth0 xdp off\n  # ethtool -k eth0 | grep gro\n  rx-gro-hw: off [requested on]\n\nAfter:\n  # ip li set dev eth0 xdp obj xdp_dummy.bpf.o sec xdp\n  # ip li set dev eth0 xdp off\n  # ethtool -k eth0 | grep gro\n  rx-gro-hw: on\n\nThe fact that HW-GRO doesn\u0027t get re-enabled automatically is just\na minor annoyance. The real issue is that the features will randomly\ncome back during another reconfiguration which just happens to invoke\nnetdev_update_features(). The driver doesn\u0027t handle reconfiguring\ntwo things at a time very robustly.\n\nStarting with commit 98ba1d931f61 (\"bnxt_en: Fix RSS logic in\n__bnxt_reserve_rings()\") we only reconfigure the RSS hash table\nif the \"effective\" number of Rx rings has changed. If HW-GRO is\nenabled \"effective\" number of rings is 2x what user sees.\nSo if we are in the bad state, with HW-GRO re-enablement \"pending\"\nafter XDP off, and we lower the rings by / 2 - the HW-GRO rings\ndoing 2x and the ethtool -L doing / 2 may cancel each other out,\nand the:\n\n  if (old_rx_rings != bp-\u003ehw_resc.resv_rx_rings \u0026\u0026\n\ncondition in __bnxt_reserve_rings() will be false.\nThe RSS map won\u0027t get updated, and we\u0027ll crash with:\n\n  BUG: kernel NULL pointer dereference, address: 0000000000000168\n  RIP: 0010:__bnxt_hwrm_vnic_set_rss+0x13a/0x1a0\n    bnxt_hwrm_vnic_rss_cfg_p5+0x47/0x180\n    __bnxt_setup_vnic_p5+0x58/0x110\n    bnxt_init_nic+0xb72/0xf50\n    __bnxt_open_nic+0x40d/0xab0\n    bnxt_open_nic+0x2b/0x60\n    ethtool_set_channels+0x18c/0x1d0\n\nAs we try to access a freed ring.\n\nThe issue is present since XDP support was added, really, but\nprior to commit 98ba1d931f61 (\"bnxt_en: Fix RSS logic in\n__bnxt_reserve_rings()\") it wasn\u0027t causing major issues."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The bug is reached only through local device-configuration interfaces \u2014 RTM_SETLINK for XDP attach/detach and the ethtool set_channels ioctl/netlink call on a bnxt netdev. No remote peer input reaches this code.\nAC:L - The commit gives a deterministic recipe: attach XDP, detach XDP, then halve the ring count so the pending HW-GRO 2x cancels the /2 and the RSS map refresh is skipped. Every input is attacker-chosen, there is no race and no memory-layout condition outside the attacker\u0027s influence.\nPR:L - Both entry points check ns_capable(net-\u003euser_ns, CAP_NET_ADMIN), which is namespace-scoped rather than requiring real root in the init namespace, so a container or namespace-confined user holding a delegated bnxt netdev (such as an SR-IOV VF) can drive the full sequence.\nUI:N - The attacker performs the XDP attach, XDP detach and channel-count change entirely on its own; no other user or administrator action is needed at any point.\nS:U - The out-of-bounds access and resulting crash are confined to the kernel\u0027s own memory and the driver\u0027s hardware configuration, within the same security authority; no VM, IOMMU or sandbox boundary is crossed.\nC:H - bnxt_fill_hw_rss_tbl_p5() indexes bp-\u003erx_ring with stale RSS indices past the end of the newly kcalloc\u0027d array, reading adjacent heap objects and then dereferencing an rx_cpr pointer taken from that out-of-bounds memory, which with heap grooming becomes an attacker-influenced arbitrary-address read.\nI:L - There is no out-of-bounds write, but garbage ring IDs harvested from the out-of-bounds read are programmed into the NIC\u0027s RSS indirection table, corrupting hardware receive steering \u2014 a bounded but real modification of state.\nA:H - The dereference of the NULL/wild rx_cpr pointer oopses inside __bnxt_open_nic() while holding rtnl_lock, taking down the network device and typically panicking or wedging the machine."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:53:36.562Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/076a694a42ae3f0466bc6e4126050eeb7b7d299a"
        },
        {
          "url": "https://git.kernel.org/stable/c/90336fc3d6f5e716ac39a9ddbbde453e23a5aa65"
        },
        {
          "url": "https://git.kernel.org/stable/c/08831a894d18abfaabb5bbde7c2069a7fb41dd93"
        },
        {
          "url": "https://git.kernel.org/stable/c/f0aa6a37a3dbb40b272df5fc6db93c114688adcd"
        }
      ],
      "title": "eth: bnxt: always recalculate features after XDP clearing, fix null-deref",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-21682",
    "datePublished": "2025-01-31T11:25:42.160Z",
    "dateReserved": "2024-12-29T08:45:45.739Z",
    "dateUpdated": "2026-09-08T08:40:17.844Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-21682",
      "date": "2026-09-16",
      "epss": "0.00233",
      "percentile": "0.14379"
    },
    "microsoft_vex": {
      "current_release_date": "2026-08-11T01:46:16.000Z",
      "cve": "CVE-2025-21682",
      "id": "msrc_CVE-2025-21682",
      "initial_release_date": "2025-09-03T21:21:53.000Z",
      "product_status:fixed": "1",
      "product_status:known_affected": "1",
      "product_status:under_investigation": "13",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "eth: bnxt: always recalculate features after XDP clearing, fix null-deref",
      "url": "https://msrc.microsoft.com/csaf/vex/2025/msrc_cve-2025-21682.json",
      "version": "11"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-21682\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-01-31T12:15:29.363\",\"lastModified\":\"2026-07-30T06:18:52.927\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\neth: bnxt: always recalculate features after XDP clearing, fix null-deref\\n\\nRecalculate features when XDP is detached.\\n\\nBefore:\\n  # ip li set dev eth0 xdp obj xdp_dummy.bpf.o sec xdp\\n  # ip li set dev eth0 xdp off\\n  # ethtool -k eth0 | grep gro\\n  rx-gro-hw: off [requested on]\\n\\nAfter:\\n  # ip li set dev eth0 xdp obj xdp_dummy.bpf.o sec xdp\\n  # ip li set dev eth0 xdp off\\n  # ethtool -k eth0 | grep gro\\n  rx-gro-hw: on\\n\\nThe fact that HW-GRO doesn\u0027t get re-enabled automatically is just\\na minor annoyance. The real issue is that the features will randomly\\ncome back during another reconfiguration which just happens to invoke\\nnetdev_update_features(). The driver doesn\u0027t handle reconfiguring\\ntwo things at a time very robustly.\\n\\nStarting with commit 98ba1d931f61 (\\\"bnxt_en: Fix RSS logic in\\n__bnxt_reserve_rings()\\\") we only reconfigure the RSS hash table\\nif the \\\"effective\\\" number of Rx rings has changed. If HW-GRO is\\nenabled \\\"effective\\\" number of rings is 2x what user sees.\\nSo if we are in the bad state, with HW-GRO re-enablement \\\"pending\\\"\\nafter XDP off, and we lower the rings by / 2 - the HW-GRO rings\\ndoing 2x and the ethtool -L doing / 2 may cancel each other out,\\nand the:\\n\\n  if (old_rx_rings != bp-\u003ehw_resc.resv_rx_rings \u0026\u0026\\n\\ncondition in __bnxt_reserve_rings() will be false.\\nThe RSS map won\u0027t get updated, and we\u0027ll crash with:\\n\\n  BUG: kernel NULL pointer dereference, address: 0000000000000168\\n  RIP: 0010:__bnxt_hwrm_vnic_set_rss+0x13a/0x1a0\\n    bnxt_hwrm_vnic_rss_cfg_p5+0x47/0x180\\n    __bnxt_setup_vnic_p5+0x58/0x110\\n    bnxt_init_nic+0xb72/0xf50\\n    __bnxt_open_nic+0x40d/0xab0\\n    bnxt_open_nic+0x2b/0x60\\n    ethtool_set_channels+0x18c/0x1d0\\n\\nAs we try to access a freed ring.\\n\\nThe issue is present since XDP support was added, really, but\\nprior to commit 98ba1d931f61 (\\\"bnxt_en: Fix RSS logic in\\n__bnxt_reserve_rings()\\\") it wasn\u0027t causing major issues.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: eth: bnxt: siempre recalcula las caracter\u00edsticas despu\u00e9s de borrar XDP, corrige null-deref Recalcula las caracter\u00edsticas cuando se desconecta XDP. Antes: # ip li set dev eth0 xdp obj xdp_dummy.bpf.o sec xdp # ip li set dev eth0 xdp off # ethtool -k eth0 | grep gro rx-gro-hw: off [solicitado el] Despu\u00e9s: # ip li set dev eth0 xdp obj xdp_dummy.bpf.o sec xdp # ip li set dev eth0 xdp off # ethtool -k eth0 | grep gro rx-gro-hw: on El hecho de que HW-GRO no se vuelva a habilitar autom\u00e1ticamente es solo una molestia menor. El problema real es que las funciones volver\u00e1n de forma aleatoria durante otra reconfiguraci\u00f3n que invoca netdev_update_features(). El controlador no gestiona la reconfiguraci\u00f3n de dos cosas a la vez de forma muy robusta. A partir de el commit 98ba1d931f61 (\\\"bnxt_en: Fix RSS logic in __bnxt_reserve_rings()\\\"), solo reconfiguramos la tabla hash RSS si el n\u00famero \\\"efectivo\\\" de anillos Rx ha cambiado. Si HW-GRO est\u00e1 habilitado, el n\u00famero \\\"efectivo\\\" de anillos es el doble de lo que ve el usuario. Entonces, si estamos en un mal estado, con la rehabilitaci\u00f3n de HW-GRO \\\"pendiente\\\" despu\u00e9s de desactivar XDP, y reducimos los anillos en / 2, los anillos de HW-GRO haciendo 2x y ethtool -L haciendo / 2 pueden cancelarse entre s\u00ed, y la condici\u00f3n: if (old_rx_rings != bp-\u0026gt;hw_resc.resv_rx_rings \u0026amp;\u0026amp; en __bnxt_reserve_rings() ser\u00e1 falsa. El mapa RSS no se actualizar\u00e1 y nos bloquearemos con: ERROR: desreferencia de puntero NULL del kernel, direcci\u00f3n: 0000000000000168 RIP: 0010:__bnxt_hwrm_vnic_set_rss+0x13a/0x1a0 bnxt_hwrm_vnic_rss_cfg_p5+0x47/0x180 __bnxt_setup_vnic_p5+0x58/0x110 bnxt_init_nic+0xb72/0xf50 __bnxt_open_nic+0x40d/0xab0 bnxt_open_nic+0x2b/0x60 ethtool_set_channels+0x18c/0x1d0 Cuando intentamos acceder a un anillo liberado, el problema est\u00e1 presente desde que se agreg\u00f3 la compatibilidad con XDP, pero antes de el commit 98ba1d931f61 (\\\"bnxt_en: Fix RSS logic in __bnxt_reserve_rings()\\\") no causaba problemas importantes.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/net/ethernet/broadcom/bnxt/bnxt.c\",\"drivers/net/ethernet/broadcom/bnxt/bnxt.h\",\"drivers/net/ethernet/broadcom/bnxt/bnxt_xdp.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"1054aee82321483dceabbb9b9e5d6512e8fe684b\",\"lessThan\":\"076a694a42ae3f0466bc6e4126050eeb7b7d299a\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"1054aee82321483dceabbb9b9e5d6512e8fe684b\",\"lessThan\":\"90336fc3d6f5e716ac39a9ddbbde453e23a5aa65\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"1054aee82321483dceabbb9b9e5d6512e8fe684b\",\"lessThan\":\"08831a894d18abfaabb5bbde7c2069a7fb41dd93\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"1054aee82321483dceabbb9b9e5d6512e8fe684b\",\"lessThan\":\"f0aa6a37a3dbb40b272df5fc6db93c114688adcd\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/net/ethernet/broadcom/bnxt/bnxt.c\",\"drivers/net/ethernet/broadcom/bnxt/bnxt.h\",\"drivers/net/ethernet/broadcom/bnxt/bnxt_xdp.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"4.16\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"4.16\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.167\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.130\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.11\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.13\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]},{\"source\":\"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e\",\"affectedData\":[{\"vendor\":\"Siemens\",\"product\":\"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP\",\"defaultStatus\":\"unknown\",\"versions\":[{\"version\":\"V3.1.6\",\"lessThan\":\"*\",\"versionType\":\"custom\",\"status\":\"affected\"}]},{\"vendor\":\"Siemens\",\"product\":\"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP\",\"defaultStatus\":\"unknown\",\"versions\":[{\"version\":\"V3.1.5\",\"lessThan\":\"*\",\"versionType\":\"custom\",\"status\":\"affected\"}]},{\"vendor\":\"Siemens\",\"product\":\"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP\",\"defaultStatus\":\"unknown\",\"versions\":[{\"version\":\"V3.1.6\",\"lessThan\":\"*\",\"versionType\":\"custom\",\"status\":\"affected\"}]},{\"vendor\":\"Siemens\",\"product\":\"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP\",\"defaultStatus\":\"unknown\",\"versions\":[{\"version\":\"V3.1.5\",\"lessThan\":\"*\",\"versionType\":\"custom\",\"status\":\"affected\"}]},{\"vendor\":\"Siemens\",\"product\":\"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP\",\"defaultStatus\":\"unknown\",\"versions\":[{\"version\":\"V3.1.6\",\"lessThan\":\"*\",\"versionType\":\"custom\",\"status\":\"affected\"}]},{\"vendor\":\"Siemens\",\"product\":\"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP\",\"defaultStatus\":\"unknown\",\"versions\":[{\"version\":\"V3.1.5\",\"lessThan\":\"*\",\"versionType\":\"custom\",\"status\":\"affected\"}]},{\"vendor\":\"Siemens\",\"product\":\"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP\",\"defaultStatus\":\"unknown\",\"versions\":[{\"version\":\"V3.1.6\",\"lessThan\":\"*\",\"versionType\":\"custom\",\"status\":\"affected\"}]},{\"vendor\":\"Siemens\",\"product\":\"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP\",\"defaultStatus\":\"unknown\",\"versions\":[{\"version\":\"V3.1.5\",\"lessThan\":\"*\",\"versionType\":\"custom\",\"status\":\"affected\"}]},{\"vendor\":\"Siemens\",\"product\":\"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP\",\"defaultStatus\":\"unknown\",\"versions\":[{\"version\":\"V3.1.6\",\"lessThan\":\"*\",\"versionType\":\"custom\",\"status\":\"affected\"}]},{\"vendor\":\"Siemens\",\"product\":\"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP\",\"defaultStatus\":\"unknown\",\"versions\":[{\"version\":\"V3.1.5\",\"lessThan\":\"*\",\"versionType\":\"custom\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H\",\"baseScore\":7.3,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"LOW\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.5},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6},{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2025-10-01T19:51:50.706963Z\",\"id\":\"CVE-2025-21682\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-476\"}]},{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-476\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.16\",\"versionEndExcluding\":\"6.12.11\",\"matchCriteriaId\":\"D85A4303-7769-4ADC-A840-D2F38DB827CE\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.13:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"62567B3C-6CEE-46D0-BC2E-B3717FBF7D13\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.13:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"5A073481-106D-4B15-B4C7-FB0213B8E1D4\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.13:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"DE491969-75AE-4A6B-9A58-8FC5AF98798F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.13:rc4:*:*:*:*:*:*\",\"matchCriteriaId\":\"93C0660D-7FB8-4FBA-892A-B064BA71E49E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.13:rc5:*:*:*:*:*:*\",\"matchCriteriaId\":\"034C36A6-C481-41F3-AE9A-D116E5BE6895\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.13:rc6:*:*:*:*:*:*\",\"matchCriteriaId\":\"8AF9DC49-2085-4FFB-A7E3-73DFAFECC7F2\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.13:rc7:*:*:*:*:*:*\",\"matchCriteriaId\":\"5DFCDFB8-4FD0-465A-9076-D813D78FE51B\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/076a694a42ae3f0466bc6e4126050eeb7b7d299a\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/08831a894d18abfaabb5bbde7c2069a7fb41dd93\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/90336fc3d6f5e716ac39a9ddbbde453e23a5aa65\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/f0aa6a37a3dbb40b272df5fc6db93c114688adcd\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://cert-portal.siemens.com/productcert/html/ssa-019113.html\",\"source\":\"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e\"},{\"url\":\"https://cert-portal.siemens.com/productcert/html/ssa-082556.html\",\"source\":\"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-09-08T11:37:15+00:00",
      "cve": "CVE-2025-21682",
      "id": "CVE-2025-21682",
      "initial_release_date": "2025-01-31T00:00:00+00:00",
      "product_status:known_affected": "260",
      "product_status:known_not_affected": "14",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: eth: bnxt: always recalculate features after XDP clearing, fix null-deref",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-21682.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-11T02:03:21Z",
      "cve": "CVE-2025-21682",
      "id": "CVE-2025-21682",
      "initial_release_date": "2025-02-01T03:47:22Z",
      "product_status:known_affected": "718",
      "product_status:known_not_affected": "68",
      "product_status:recommended": "384",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2025-21682",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2025-21682.json",
      "version": "63"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"affected\": [{\"vendor\": \"Siemens\", \"product\": \"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP\", \"versions\": [{\"status\": \"affected\", \"version\": \"V3.1.6\", \"lessThan\": \"*\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unknown\"}, {\"vendor\": \"Siemens\", \"product\": \"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP\", \"versions\": [{\"status\": \"affected\", \"version\": \"V3.1.5\", \"lessThan\": \"*\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unknown\"}, {\"vendor\": \"Siemens\", \"product\": \"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP\", \"versions\": [{\"status\": \"affected\", \"version\": \"V3.1.6\", \"lessThan\": \"*\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unknown\"}, {\"vendor\": \"Siemens\", \"product\": \"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP\", \"versions\": [{\"status\": \"affected\", \"version\": \"V3.1.5\", \"lessThan\": \"*\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unknown\"}, {\"vendor\": \"Siemens\", \"product\": \"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP\", \"versions\": [{\"status\": \"affected\", \"version\": \"V3.1.6\", \"lessThan\": \"*\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unknown\"}, {\"vendor\": \"Siemens\", \"product\": \"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP\", \"versions\": [{\"status\": \"affected\", \"version\": \"V3.1.5\", \"lessThan\": \"*\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unknown\"}, {\"vendor\": \"Siemens\", \"product\": \"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP\", \"versions\": [{\"status\": \"affected\", \"version\": \"V3.1.6\", \"lessThan\": \"*\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unknown\"}, {\"vendor\": \"Siemens\", \"product\": \"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP\", \"versions\": [{\"status\": \"affected\", \"version\": \"V3.1.5\", \"lessThan\": \"*\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unknown\"}, {\"vendor\": \"Siemens\", \"product\": \"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP\", \"versions\": [{\"status\": \"affected\", \"version\": \"V3.1.6\", \"lessThan\": \"*\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unknown\"}, {\"vendor\": \"Siemens\", \"product\": \"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP\", \"versions\": [{\"status\": \"affected\", \"version\": \"V3.1.5\", \"lessThan\": \"*\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unknown\"}], \"x_adpType\": \"supplier\", \"references\": [{\"url\": \"https://cert-portal.siemens.com/productcert/html/ssa-082556.html\"}, {\"url\": \"https://cert-portal.siemens.com/productcert/html/ssa-019113.html\"}], \"providerMetadata\": {\"orgId\": \"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e\", \"shortName\": \"siemens-SADP\", \"dateUpdated\": \"2026-09-08T08:40:17.844Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 5.5, \"attackVector\": \"LOCAL\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\", \"integrityImpact\": \"NONE\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"NONE\"}}, {\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2025-21682\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2025-10-01T19:51:50.706963Z\"}}}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-476\", \"description\": \"CWE-476 NULL Pointer Dereference\"}]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2025-10-01T15:59:14.025Z\"}}], \"cna\": {\"title\": \"eth: bnxt: always recalculate features after XDP clearing, fix null-deref\", \"metrics\": [{\"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 7.3, \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"AV:L - The bug is reached only through local device-configuration interfaces \\u2014 RTM_SETLINK for XDP attach/detach and the ethtool set_channels ioctl/netlink call on a bnxt netdev. No remote peer input reaches this code.\\nAC:L - The commit gives a deterministic recipe: attach XDP, detach XDP, then halve the ring count so the pending HW-GRO 2x cancels the /2 and the RSS map refresh is skipped. Every input is attacker-chosen, there is no race and no memory-layout condition outside the attacker\u0027s influence.\\nPR:L - Both entry points check ns_capable(net-\u003euser_ns, CAP_NET_ADMIN), which is namespace-scoped rather than requiring real root in the init namespace, so a container or namespace-confined user holding a delegated bnxt netdev (such as an SR-IOV VF) can drive the full sequence.\\nUI:N - The attacker performs the XDP attach, XDP detach and channel-count change entirely on its own; no other user or administrator action is needed at any point.\\nS:U - The out-of-bounds access and resulting crash are confined to the kernel\u0027s own memory and the driver\u0027s hardware configuration, within the same security authority; no VM, IOMMU or sandbox boundary is crossed.\\nC:H - bnxt_fill_hw_rss_tbl_p5() indexes bp-\u003erx_ring with stale RSS indices past the end of the newly kcalloc\u0027d array, reading adjacent heap objects and then dereferencing an rx_cpr pointer taken from that out-of-bounds memory, which with heap grooming becomes an attacker-influenced arbitrary-address read.\\nI:L - There is no out-of-bounds write, but garbage ring IDs harvested from the out-of-bounds read are programmed into the NIC\u0027s RSS indirection table, corrupting hardware receive steering \\u2014 a bounded but real modification of state.\\nA:H - The dereference of the NULL/wild rx_cpr pointer oopses inside __bnxt_open_nic() while holding rtnl_lock, taking down the network device and typically panicking or wedging the machine.\"}]}], \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"1054aee82321483dceabbb9b9e5d6512e8fe684b\", \"lessThan\": \"076a694a42ae3f0466bc6e4126050eeb7b7d299a\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"1054aee82321483dceabbb9b9e5d6512e8fe684b\", \"lessThan\": \"90336fc3d6f5e716ac39a9ddbbde453e23a5aa65\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"1054aee82321483dceabbb9b9e5d6512e8fe684b\", \"lessThan\": \"08831a894d18abfaabb5bbde7c2069a7fb41dd93\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"1054aee82321483dceabbb9b9e5d6512e8fe684b\", \"lessThan\": \"f0aa6a37a3dbb40b272df5fc6db93c114688adcd\", \"versionType\": \"git\"}], \"programFiles\": [\"drivers/net/ethernet/broadcom/bnxt/bnxt.c\", \"drivers/net/ethernet/broadcom/bnxt/bnxt.h\", \"drivers/net/ethernet/broadcom/bnxt/bnxt_xdp.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"4.16\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"4.16\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"6.1.167\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.1.*\"}, {\"status\": \"unaffected\", \"version\": \"6.6.130\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.6.*\"}, {\"status\": \"unaffected\", \"version\": \"6.12.11\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.12.*\"}, {\"status\": \"unaffected\", \"version\": \"6.13\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"drivers/net/ethernet/broadcom/bnxt/bnxt.c\", \"drivers/net/ethernet/broadcom/bnxt/bnxt.h\", \"drivers/net/ethernet/broadcom/bnxt/bnxt_xdp.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/076a694a42ae3f0466bc6e4126050eeb7b7d299a\"}, {\"url\": \"https://git.kernel.org/stable/c/90336fc3d6f5e716ac39a9ddbbde453e23a5aa65\"}, {\"url\": \"https://git.kernel.org/stable/c/08831a894d18abfaabb5bbde7c2069a7fb41dd93\"}, {\"url\": \"https://git.kernel.org/stable/c/f0aa6a37a3dbb40b272df5fc6db93c114688adcd\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\neth: bnxt: always recalculate features after XDP clearing, fix null-deref\\n\\nRecalculate features when XDP is detached.\\n\\nBefore:\\n  # ip li set dev eth0 xdp obj xdp_dummy.bpf.o sec xdp\\n  # ip li set dev eth0 xdp off\\n  # ethtool -k eth0 | grep gro\\n  rx-gro-hw: off [requested on]\\n\\nAfter:\\n  # ip li set dev eth0 xdp obj xdp_dummy.bpf.o sec xdp\\n  # ip li set dev eth0 xdp off\\n  # ethtool -k eth0 | grep gro\\n  rx-gro-hw: on\\n\\nThe fact that HW-GRO doesn\u0027t get re-enabled automatically is just\\na minor annoyance. The real issue is that the features will randomly\\ncome back during another reconfiguration which just happens to invoke\\nnetdev_update_features(). The driver doesn\u0027t handle reconfiguring\\ntwo things at a time very robustly.\\n\\nStarting with commit 98ba1d931f61 (\\\"bnxt_en: Fix RSS logic in\\n__bnxt_reserve_rings()\\\") we only reconfigure the RSS hash table\\nif the \\\"effective\\\" number of Rx rings has changed. If HW-GRO is\\nenabled \\\"effective\\\" number of rings is 2x what user sees.\\nSo if we are in the bad state, with HW-GRO re-enablement \\\"pending\\\"\\nafter XDP off, and we lower the rings by / 2 - the HW-GRO rings\\ndoing 2x and the ethtool -L doing / 2 may cancel each other out,\\nand the:\\n\\n  if (old_rx_rings != bp-\u003ehw_resc.resv_rx_rings \u0026\u0026\\n\\ncondition in __bnxt_reserve_rings() will be false.\\nThe RSS map won\u0027t get updated, and we\u0027ll crash with:\\n\\n  BUG: kernel NULL pointer dereference, address: 0000000000000168\\n  RIP: 0010:__bnxt_hwrm_vnic_set_rss+0x13a/0x1a0\\n    bnxt_hwrm_vnic_rss_cfg_p5+0x47/0x180\\n    __bnxt_setup_vnic_p5+0x58/0x110\\n    bnxt_init_nic+0xb72/0xf50\\n    __bnxt_open_nic+0x40d/0xab0\\n    bnxt_open_nic+0x2b/0x60\\n    ethtool_set_channels+0x18c/0x1d0\\n\\nAs we try to access a freed ring.\\n\\nThe issue is present since XDP support was added, really, but\\nprior to commit 98ba1d931f61 (\\\"bnxt_en: Fix RSS logic in\\n__bnxt_reserve_rings()\\\") it wasn\u0027t causing major issues.\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.1.167\", \"versionStartIncluding\": \"4.16\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.6.130\", \"versionStartIncluding\": \"4.16\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.12.11\", \"versionStartIncluding\": \"4.16\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.13\", \"versionStartIncluding\": \"4.16\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-08-05T11:53:36.562Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2025-21682\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-09-08T08:40:17.844Z\", \"dateReserved\": \"2024-12-29T08:45:45.739Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2025-01-31T11:25:42.160Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.