{
  "schema_version": "1.6.1",
  "id": "RPI-CVE-2025-39810",
  "modified": "2026-10-09T11:39:44Z",
  "upstream": [
    "CVE-2025-39810"
  ],
  "published": "2025-09-16T13:00:44Z",
  "summary": "bnxt_en: Fix memory corruption when FW resources change during ifdown",
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nbnxt_en: Fix memory corruption when FW resources change during ifdown\n\nbnxt_set_dflt_rings() assumes that it is always called before any TC has\nbeen created.  So it doesn't take bp->num_tc into account and assumes\nthat it is always 0 or 1.\n\nIn the FW resource or capability change scenario, the FW will return\nflags in bnxt_hwrm_if_change() that will cause the driver to\nreinitialize and call bnxt_cancel_reservations().  This will lead to\nbnxt_init_dflt_ring_mode() calling bnxt_set_dflt_rings() and bp->num_tc\nmay be greater than 1.  This will cause bp->tx_ring[] to be sized too\nsmall and cause memory corruption in bnxt_alloc_cp_rings().\n\nFix it by properly scaling the TX rings by bp->num_tc in the code\npaths mentioned above.  Add 2 helper functions to determine\nbp->tx_nr_rings and bp->tx_nr_rings_per_tc.",
  "severity": [
    {
      "type": "CVSS_V3",
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
    }
  ],
  "affected": [
    {
      "package": {
        "ecosystem": "Raspberry Pi OS:12",
        "name": "linux"
      },
      "versions": [
        "1:6.1.47-1+rpt4"
      ],
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-2712",
            "binary_version": "1:6.1.47-1+rpt4"
          },
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-v6",
            "binary_version": "1:6.1.47-1+rpt4"
          },
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-v7",
            "binary_version": "1:6.1.47-1+rpt4"
          },
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-v7l",
            "binary_version": "1:6.1.47-1+rpt4"
          },
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-v8",
            "binary_version": "1:6.1.47-1+rpt4"
          }
        ]
      },
      "database_specific": {
        "per_version": {
          "1:6.1.47-1+rpt4": {
            "linux_commit": "655fc658a15ae7a6f37103754adb39ba52a9a14e",
            "upstream_version": "6.1.47",
            "assessment": "commit ancestry (strak rule)",
            "upstream_fixed": null,
            "compiled_filter": false
          }
        }
      }
    }
  ],
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-39810"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/d00e98977ef519280b075d783653e2c492fffbb6"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/9ab6a9950f152e094395d2e3967f889857daa185"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/2747328ba2714f1a7454208dbbc1dc0631990b4a"
    }
  ],
  "database_specific": {
    "source": "https://git.kernel.org/pub/scm/linux/security/vulns.git",
    "upstream_modified": "2026-08-05T12:19:11Z",
    "severity": {
      "source": "kernel CNA",
      "cvss_v3_score": 7.8,
      "cvss_v3_severity": "High",
      "scenario": "AV:L - The trigger sequence is local device configuration \u2014 mqprio/DCBNL to set `bp->num_tc > 1` via rtnetlink, then a link down/up cycle through `bnxt_open()`. No remote peer traffic or network protocol data reaches the vulnerable computation.\nAC:L - The attacker arms the condition persistently: once multi-TC is configured, every subsequent ifup that sees a firmware `RESC_CHANGE`/`CAPS_CHANGE` deterministically undersizes `bp->tx_ring[]`, and such resource changes are routine recurring events (SR-IOV VF count changes, RoCE driver load/unload, firmware update, PF reconfiguration) that can simply be waited out and re-triggered by cycling the interface \u2014 there is no one-shot race to win.\nPR:L - Reaching the path needs CAP_NET_ADMIN over the bnxt netdev, which in the common SR-IOV cloud/Kubernetes deployment is held by an otherwise unprivileged container after a VF is delegated into its user-namespace-owned network namespace, where `tc qdisc add ... mqprio` and `ip link set up` are permitted. That is delegated network-admin capability, not real root in the init namespace.\nUI:N - No victim action is needed \u2014 the corruption occurs entirely within the attacker's own interface bring-up sequence once the multi-TC configuration is in place.\nS:U - The out-of-bounds write corrupts kernel heap objects belonging to the same kernel security authority; no VM, IOMMU, or hypervisor boundary is crossed.\nC:H - The overflow plants live `bnxt_cp_ring_info` pointers into adjacent heap objects and leaves `netdev_set_tc_queue()` mappings pointing past `real_num_tx_queues`, so subsequent TX-completion and queue-selection code dereferences and reads memory outside the intended objects, which is leverageable for kernel memory disclosure.\nI:H - `bp->tx_ring[n].tx_cpr = cpr2` writes a kernel heap pointer well beyond the `kcalloc`'d array, at an offset scaled by the attacker-chosen `num_tc` and per-TC ring count \u2014 a placement-influenceable arbitrary-ish pointer write into neighbouring slab objects, the classic primitive for control-flow hijack.\nA:H - Corrupting unrelated heap allocations with stray pointers, plus TX queues indexed past `real_num_tx_queues`, reliably produces oops/panic on a machine performing normal networking, and the sequence can be repeated at will."
    }
  }
}