CVE-2025-22108

What it actually does

Improper masking of the 5-bit bd_cnt field in TX BDs allows values exceeding 32 (when CONFIG_MAX_SKB_FRAGS is increased) to corrupt the TX BD structure instead of wrapping to 0, resulting in invalid hardware descriptors.

Why it matters to the business

Network interface instability and transmission halts on affected systems can disrupt connectivity, increase latency, and require manual intervention or reboots in high-throughput environments using Broadcom NetXtreme adapters.

How an attack unfolds

An attacker or workload crafts SKBs with fragment counts approaching or exceeding the hardware limit; the driver writes an out-of-range bd_cnt value into the TX BD; the unmasked value corrupts adjacent BD fields; the NIC encounters invalid descriptors and triggers a TX timeout, halting packet transmission.

How to fix it

Apply the upstream fix (commit f60b41b815826f15c4d0323f923f398c423178d0) or upgrade to a kernel containing the corrected bd_cnt masking macro; Red Hat rhevm-spice-client packages should be updated to 0:3.3-12.el6_5 or newer.

How to confirm the fix worked

Confirm the presence of the masking macro in bnxt_en driver source; monitor kernel logs after loading high-fragment workloads to verify absence of TX timeouts; check git commit or package version against the fixed references.

Typical attack path

1. Increase CONFIG_MAX_SKB_FRAGS or generate SKBs with many fragments via application or network traffic
2. Driver populates TX BD without masking bd_cnt
3. Hardware receives corrupted BD descriptor
4. TX ring stalls and firmware reports timeout
5. Interface becomes unresponsive until reset

How to detect it

Search kernel logs and dmesg for bnxt_en TX timeout messages or descriptor corruption warnings; correlate with high-fragment packet activity or recent changes to MAX_SKB_FRAGS settings.

• bnxt_en.*TX timeout
• bd_cnt.*corrupt
• skb frag count exceeds 32

What your security team should do

• Prioritize kernel upgrades on systems exposing Broadcom bnxt_en interfaces to production traffic
• Audit and cap CONFIG_MAX_SKB_FRAGS where possible
• Enable kernel TX timeout logging and alerting for bnxt_en devices
• Test patched kernels under maximum fragment workloads before broad deployment