CVE-2024-40919

What it actually does

NULL pointer dereference in __hwrm_send() logging path when token state is BNXT_HWRM_DEFERRED and firmware omits HWRM_ERR_CODE_PF_UNAVAILABLE, allowing released (NULL) token pointer to be dereferenced.

Why it matters to the business

Kernel crashes or instability on Linux systems using Broadcom bnxt_en Ethernet adapters can interrupt network connectivity, storage, or virtualization workloads until the system is restarted or the driver is updated.

How an attack unfolds

An attacker with local or network access triggers firmware paths that set token state to deferred; when older firmware omits the expected error code, the subsequent logging code dereferences the now-NULL token, causing a kernel oops that may be leveraged for denial of service or, under specific memory conditions, further corruption.

How to fix it

Upgrade the Linux kernel to the commit cde177fa235cd36f981012504a6376315bac03c9 or later stable releases containing the token pointer check before the log statement.

How to confirm the fix worked

Confirm the presence of the added token pointer validation in __hwrm_send() source, or verify running kernel contains cde177fa235cd36f981012504a6376315bac03c9 and test with firmware that omits HWRM_ERR_CODE_PF_UNAVAILABLE.

Typical attack path

1. Identify systems running vulnerable bnxt_en driver with affected firmware
2. Send crafted HWRM commands or network traffic that causes token release via BNXT_HWRM_DEFERRED state
3. Trigger logging code path without the PF_UNAVAILABLE error code
4. NULL dereference occurs leading to kernel panic or exploitable corruption

How to detect it

Search kernel logs, dmesg, or systemd journal for oops/panic entries containing bnxt_en, __hwrm_send, or NULL pointer dereference near HWRM token handling; correlate with network activity on affected adapters.

• __hwrm_send
• BNXT_HWRM_DEFERRED
• token->state

What your security team should do

• Apply the referenced kernel commit or distribution update containing the fix as soon as possible
• Monitor for kernel oops or panic logs referencing bnxt_en or __hwrm_send
• Restrict unprivileged local access on systems using bnxt_en until patched