CVE-2025-38439

What it actually does

The flaw causes dma_unmap_len_set to be called with length 0 instead of the correct packet length during XDP_REDIRECT transmission in the bnxt_en driver, resulting in incorrect IOMMU DMA unmapping and a kernel warning on systems with IOMMU enabled.

Why it matters to the business

Affected Linux systems using Broadcom network adapters may encounter kernel warnings, potential packet processing failures, or instability in networking stacks, raising operational risk and downtime likelihood in containerized or virtualized deployments where XDP is common.

How an attack unfolds

Attackers leverage XDP redirect paths in the bnxt_en driver, often in container-optimized environments, to trigger the incorrect DMA unmap; this has been associated with advanced spyware campaigns and Linux kernel privilege escalation attempts in containerized OS targets, potentially leading to memory corruption or denial of service.

How to fix it

Update to fixed kernel packages: linux 6.12.41-1 on Debian 13, linux 6.16.3-1 on Debian 14, or apply commit e260f4d49370c85a4701d43c6d16b8c39f8b605f from the stable Linux git tree.

How to confirm the fix worked

Confirm upgraded kernel versions, reproduce XDP_REDIRECT traffic, and verify absence of __iommu_dma_unmap warnings in dmesg or kernel logs.

Typical attack path

1. Scan for systems running vulnerable bnxt_en driver versions with IOMMU active
2. Deploy or trigger XDP programs capable of XDP_REDIRECT operations
3. Force transmission of redirected frames to invoke bnxt_tx_int_xdp
4. Exploit resulting IOMMU unmap inconsistency for memory corruption or further escalation

How to detect it

Search kernel logs for __iommu_dma_unmap warnings originating from bnxt_tx_int_xdp or xdp_return_frame call paths, particularly on hosts running container workloads or affected by listed Linux privilege escalation campaigns.

What your security team should do

• Apply kernel updates immediately on all systems exposing bnxt_en with IOMMU
• Audit container networking configurations that rely on XDP redirect
• Enable enhanced kernel logging for DMA and IOMMU events pending patches
• Monitor EPSS trend and related Linux kernel campaigns for increased exploitation likelihood