CVE-2025-37873 (GCVE-0-2025-37873)

Vulnerability from cvelistv5 – Published: 2025-05-09 06:44 – Updated: 2026-08-05 11:57
VLAI
Title
eth: bnxt: fix missing ring index trim on error path
Summary
In the Linux kernel, the following vulnerability has been resolved: eth: bnxt: fix missing ring index trim on error path Commit under Fixes converted tx_prod to be free running but missed masking it on the Tx error path. This crashes on error conditions, for example when DMA mapping fails.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: 6d1add95536bafe585c500ad8114af7ed4225a0f , < 21e70f694bc0dcb40174b0940cc52a7769fc19e0 (git)
Affected: 6d1add95536bafe585c500ad8114af7ed4225a0f , < 3742c55de00266fa7c8fd2c5d61a453d223a9cd1 (git)
Affected: 6d1add95536bafe585c500ad8114af7ed4225a0f , < 12f2d033fae957d84c2c0ce604d2a077e61fa2c0 (git)
Create a notification for this product.
Linux Linux Affected: 6.8
Unaffected: 0 , < 6.8 (semver)
Unaffected: 6.12.25 , ≤ 6.12.* (semver)
Unaffected: 6.14.4 , ≤ 6.14.* (semver)
Unaffected: 6.15 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/broadcom/bnxt/bnxt.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "21e70f694bc0dcb40174b0940cc52a7769fc19e0",
              "status": "affected",
              "version": "6d1add95536bafe585c500ad8114af7ed4225a0f",
              "versionType": "git"
            },
            {
              "lessThan": "3742c55de00266fa7c8fd2c5d61a453d223a9cd1",
              "status": "affected",
              "version": "6d1add95536bafe585c500ad8114af7ed4225a0f",
              "versionType": "git"
            },
            {
              "lessThan": "12f2d033fae957d84c2c0ce604d2a077e61fa2c0",
              "status": "affected",
              "version": "6d1add95536bafe585c500ad8114af7ed4225a0f",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/broadcom/bnxt/bnxt.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.8"
            },
            {
              "lessThan": "6.8",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.25",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.14.*",
              "status": "unaffected",
              "version": "6.14.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.15",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.25",
                  "versionStartIncluding": "6.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.14.4",
                  "versionStartIncluding": "6.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.15",
                  "versionStartIncluding": "6.8",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\neth: bnxt: fix missing ring index trim on error path\n\nCommit under Fixes converted tx_prod to be free running but missed\nmasking it on the Tx error path. This crashes on error conditions,\nfor example when DMA mapping fails."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The defect is in `bnxt_start_xmit()`, the driver\u0027s local transmit path, reached by a local process sending packets through the bnxt interface; it does not parse remote peer data, so a remote attacker cannot directly drive the error path.\nAC:L - The error conditions are resource-exhaustion states the attacker can themselves induce (swiotlb/IOMMU exhaustion for `dma_map_single()`, memory pressure for `skb_pad()`/`skb_cow_head()`), and `tx_prod` exceeds `tx_ring_mask` ~99.2% of the time and is steerable by simply sending packets.\nPR:L - Any unprivileged local user can transmit packets out the bnxt NIC via ordinary sockets and generate the memory/DMA pressure needed; no capability, netlink permission, or admin gate exists on this path.\nUI:N - The OOB write occurs entirely within the attacker\u0027s own `sendmsg()`/xmit path with no victim action required.\nS:U - The corruption stays within kernel memory managed by the same security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - The unmasked index yields an out-of-bounds write up to ~2.6 MB past a 20 KB vzalloc\u0027d ring into neighbouring vmalloc objects (kernel stacks, other rings, module data); zeroing a pointer or length field in an adjacent structure is memory corruption that can be leveraged for information disclosure.\nI:H - This is a genuine out-of-bounds write with an attacker-steerable offset over a multi-megabyte window of vmalloc space, corrupting unrelated kernel structures.\nA:H - The commit states outright that the unmasked index \"crashes on error conditions\"; the write typically lands on a vmalloc guard page or unmapped region, producing a kernel oops/panic."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:57:58.207Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/21e70f694bc0dcb40174b0940cc52a7769fc19e0"
        },
        {
          "url": "https://git.kernel.org/stable/c/3742c55de00266fa7c8fd2c5d61a453d223a9cd1"
        },
        {
          "url": "https://git.kernel.org/stable/c/12f2d033fae957d84c2c0ce604d2a077e61fa2c0"
        }
      ],
      "title": "eth: bnxt: fix missing ring index trim on error path",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-37873",
    "datePublished": "2025-05-09T06:44:01.394Z",
    "dateReserved": "2025-04-16T04:51:23.959Z",
    "dateUpdated": "2026-08-05T11:57:58.207Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-37873",
      "date": "2026-08-11",
      "epss": "0.00282",
      "percentile": "0.20442"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-37873\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-05-09T07:16:08.440\",\"lastModified\":\"2026-07-30T06:22:26.557\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\neth: bnxt: fix missing ring index trim on error path\\n\\nCommit under Fixes converted tx_prod to be free running but missed\\nmasking it on the Tx error path. This crashes on error conditions,\\nfor example when DMA mapping fails.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: eth: bnxt: se corrige la falta de recorte del \u00edndice de anillo en la ruta de error. La confirmaci\u00f3n bajo \\\"Correcciones\\\" convirti\u00f3 tx_prod para que se ejecutara libremente, pero no lo enmascar\u00f3 en la ruta de error de Tx. Esto falla en condiciones de error, por ejemplo, cuando falla la asignaci\u00f3n de DMA.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/net/ethernet/broadcom/bnxt/bnxt.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6d1add95536bafe585c500ad8114af7ed4225a0f\",\"lessThan\":\"21e70f694bc0dcb40174b0940cc52a7769fc19e0\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"6d1add95536bafe585c500ad8114af7ed4225a0f\",\"lessThan\":\"3742c55de00266fa7c8fd2c5d61a453d223a9cd1\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"6d1add95536bafe585c500ad8114af7ed4225a0f\",\"lessThan\":\"12f2d033fae957d84c2c0ce604d2a077e61fa2c0\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/net/ethernet/broadcom/bnxt/bnxt.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.8\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.8\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.25\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.14.4\",\"lessThanOrEqual\":\"6.14.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.15\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"NVD-CWE-noinfo\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.8\",\"versionEndExcluding\":\"6.12.25\",\"matchCriteriaId\":\"CBBDA0D8-E64F-41F7-ADFF-19A22F63B1B9\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.13\",\"versionEndExcluding\":\"6.14.4\",\"matchCriteriaId\":\"29FA1A8E-1C2A-4B0B-B397-2C915ECDEDEE\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.15:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"8D465631-2980-487A-8E65-40AE2B9F8ED1\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.15:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"4C9D071F-B28E-46EC-AC61-22B913390211\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/12f2d033fae957d84c2c0ce604d2a077e61fa2c0\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/21e70f694bc0dcb40174b0940cc52a7769fc19e0\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/3742c55de00266fa7c8fd2c5d61a453d223a9cd1\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-07-30T09:32:20+00:00",
      "cve": "CVE-2025-37873",
      "id": "CVE-2025-37873",
      "initial_release_date": "2025-05-09T00:00:00+00:00",
      "product_status:known_affected": "212",
      "product_status:known_not_affected": "62",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: eth: bnxt: fix missing ring index trim on error path",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-37873.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-07-25T00:55:30Z",
      "cve": "CVE-2025-37873",
      "id": "CVE-2025-37873",
      "initial_release_date": "2025-05-10T02:52:32Z",
      "product_status:known_affected": "451",
      "product_status:known_not_affected": "251",
      "product_status:recommended": "407",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2025-37873",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2025-37873.json",
      "version": "39"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.