CVE-2025-21682

What it actually does

The vulnerability causes a null pointer dereference in the bnxt network driver when XDP is disabled and subsequent ring reconfiguration occurs, leading to a kernel crash due to accessing freed memory structures during RSS hash table updates.

Why it matters to the business

Systems using Broadcom bnxt Ethernet adapters may experience unexpected kernel panics and reboots during network configuration changes, resulting in downtime and potential data loss on affected Linux hosts.

How an attack unfolds

An attacker with local privileges detaches an XDP program from a bnxt interface, then performs ethtool channel reconfiguration that triggers netdev_update_features without proper RSS update, causing the driver to dereference invalid pointers during NIC initialization and crash the kernel.

How to fix it

Update the Linux kernel to a version containing commit 08831a894d18abfaabb5bbde7c2069a7fb41dd93 or later for all affected stable branches.

How to confirm the fix worked

Confirm the running kernel includes the fix commit, then test XDP attach/detach sequences followed by ethtool channel modifications to ensure no NULL dereference occurs.

Typical attack path

1. Obtain local access to a system with bnxt hardware
2. Attach then detach an XDP program on the bnxt interface
3. Use ethtool to lower ring counts via -L
4. Trigger netdev feature updates leading to invalid ring access

How to detect it

Review kernel logs and dmesg output for NULL pointer dereference crashes in bnxt driver functions such as __bnxt_hwrm_vnic_set_rss or bnxt_init_nic following XDP or ethtool operations.

• BUG: kernel NULL pointer dereference, address: 0000000000000168
• RIP: __bnxt_hwrm_vnic_set_rss+0x13a/0x1a0
• bnxt_hwrm_vnic_rss_cfg_p5
• __bnxt_setup_vnic_p5
• bnxt_init_nic
• ethtool_set_channels

What your security team should do

• Apply the referenced kernel commit or newer releases immediately on systems with bnxt adapters
• Restrict unprivileged local access until patches are deployed
• Monitor kernel logs for bnxt-related panics as a temporary detection measure