CVE-2025-39810

What it actually does

Memory corruption in bnxt_en driver when bnxt_set_dflt_rings assumes num_tc is 0 or 1 but num_tc > 1 after FW resource change triggers reinitialization via bnxt_cancel_reservations and bnxt_init_dflt_ring_mode, resulting in undersized tx_ring[] and overflow in bnxt_alloc_cp_rings.

Why it matters to the business

Network interface instability or crashes on Linux systems using bnxt_en hardware during firmware capability changes or interface restarts, increasing operational downtime risk especially on high-traffic servers; low but rising exploit probability noted over recent months.

How an attack unfolds

An attacker with local access or ability to influence interface state and firmware resource reporting induces a change scenario during ifdown; the driver reinitializes without scaling TX rings for multiple traffic classes, triggering memory corruption that may be leveraged for denial of service or further escalation by groups such as VMSCAPE in container-optimized environments.

How to fix it

Update to fixed kernel versions containing commit d00e98977ef519280b075d783653e2c492fffbb6 or later; apply the two new helper functions that correctly scale tx_nr_rings and tx_nr_rings_per_tc by num_tc in all relevant code paths; for Debian packages update ircii to 20030315-1 and epic4 to 1:1.1.11.20030409-1 where applicable.

How to confirm the fix worked

Confirm kernel source contains the scaling helpers and updated ring allocation logic; verify no calls to bnxt_set_dflt_rings occur without accounting for num_tc; test interface down/up cycles under simulated firmware resource change conditions and monitor for ring allocation sizes matching expected traffic class counts.

Typical attack path

1. Gain local access or control interface state on target system
2. Trigger interface down combined with firmware resource or capability change notification
3. Force driver reinitialization path through bnxt_hwrm_if_change returning flags that call bnxt_cancel_reservations
4. Invoke bnxt_set_dflt_rings with num_tc > 1 leading to undersized ring allocation
5. Trigger overflow during bnxt_alloc_cp_rings to achieve corruption

How to detect it

Review kernel logs and dmesg for bnxt_en ring allocation warnings or corruption indicators around interface down events; correlate with bnxt_hwrm_if_change calls returning reinitialization flags; inspect for unexpected num_tc values greater than 1 during driver init; check system stability during firmware updates or capability changes.

What your security team should do

• Prioritize patching production systems using bnxt_en within 30 days given rising EPSS trend
• Audit environments for use of affected kernel versions and schedule staged rollouts of the fixed commit
• Monitor for any reported container-optimized OS privilege escalation attempts tied to related kernel issues
• Implement interface state change logging and resource change alerts to detect triggering conditions early