CVE-2025-39810: Linux Kernel Buffer Overflow Vulnerability

CVE-2025-39810 Overview

CVE-2025-39810 is a memory corruption vulnerability in the Linux kernel's bnxt_en Broadcom NetXtreme Ethernet driver. The flaw resides in bnxt_set_dflt_rings(), which incorrectly assumes it runs before any traffic class (TC) is created and treats bp->num_tc as always 0 or 1. When firmware (FW) resources or capabilities change during ifdown, the driver reinitializes through bnxt_hwrm_if_change() and calls bnxt_cancel_reservations(), which can invoke bnxt_set_dflt_rings() with bp->num_tc greater than 1. This undersizes bp->tx_ring[] and causes out-of-bounds memory corruption inside bnxt_alloc_cp_rings() [CWE-787].

Critical Impact
A local attacker with the ability to trigger interface state changes on systems using Broadcom NetXtreme adapters can cause kernel memory corruption, leading to privilege escalation, denial of service, or arbitrary code execution in kernel context.

Affected Products

Linux kernel 6.17-rc1
Linux kernel 6.17-rc2
Linux kernel 6.17-rc3

Discovery Timeline

2025-09-16 - CVE-2025-39810 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-39810

Vulnerability Analysis

The bnxt_en driver manages Broadcom NetXtreme network adapters and supports multiple traffic classes (TCs) for quality-of-service scheduling. Ring buffers are allocated per TC, so total TX rings equal tx_nr_rings_per_tc * num_tc.

The function bnxt_set_dflt_rings() was originally written under the assumption that it executes only during initial device probe, before any TC configuration exists. The function therefore sizes the TX ring array without multiplying by bp->num_tc. When invoked in the post-initialization firmware resource change path, the array is allocated too small for the current TC count.

Subsequently, bnxt_alloc_cp_rings() writes into bp->tx_ring[] using indices computed from the full tx_nr_rings value. Writes beyond the allocated boundary corrupt adjacent kernel heap memory, satisfying the conditions of an out-of-bounds write.

Root Cause

The root cause is a stale precondition in bnxt_set_dflt_rings(). The function does not account for bp->num_tc when computing default ring counts. When the firmware returns capability-change flags in bnxt_hwrm_if_change(), the driver calls bnxt_cancel_reservations(), which routes through bnxt_init_dflt_ring_mode() and reaches bnxt_set_dflt_rings() while multiple TCs are already active.

Attack Vector

Exploitation requires local access with privileges sufficient to bring the network interface down or trigger a firmware capability change event. This typically maps to CAP_NET_ADMIN. An attacker who can influence the timing of an ifdown alongside a firmware resource change can force the undersized allocation and corrupt kernel memory. The vulnerability is not remotely exploitable.

No public proof-of-concept exploit is currently available, and the flaw is not listed in the CISA Known Exploited Vulnerabilities catalog. The upstream fix scales TX rings by bp->num_tc and introduces two helper functions to consistently compute bp->tx_nr_rings and bp->tx_nr_rings_per_tc.

Detection Methods for CVE-2025-39810

Indicators of Compromise

Unexpected kernel oops or panic messages referencing bnxt_alloc_cp_rings, bnxt_set_dflt_rings, or bnxt_init_dflt_ring_mode in dmesg or /var/log/kern.log.
KASAN slab-out-of-bounds reports naming the bnxt_en module on hosts equipped with Broadcom NetXtreme adapters.
Interface flapping (ifdown/ifup cycles) correlated with firmware capability change events immediately preceding kernel instability.

Detection Strategies

Enable Kernel Address Sanitizer (KASAN) on test kernels running 6.17-rc1 through 6.17-rc3 to surface out-of-bounds writes in the bnxt_en ring allocation path.
Audit installed kernel versions across the fleet and flag hosts running affected 6.17 release candidates with Broadcom NetXtreme hardware.
Correlate kernel crash telemetry with recent netlink interface state transitions to identify exploitation attempts.

Monitoring Recommendations

Forward kernel logs to a centralized logging platform and alert on stack traces containing bnxt_ symbols.
Monitor auditd for invocations of ip link set, ifconfig down, or equivalent commands issued by non-administrative accounts.
Track firmware version transitions on Broadcom adapters, since capability changes are a prerequisite for reaching the vulnerable code path.

How to Mitigate CVE-2025-39810

Immediate Actions Required

Upgrade to a Linux kernel build that includes the fix commits 2747328ba271, 9ab6a9950f15, or d00e98977ef5 from the stable tree.
Restrict CAP_NET_ADMIN and root-equivalent privileges to trusted administrators to reduce the pool of users capable of triggering interface state changes.
Inventory systems using Broadcom NetXtreme (bnxt_en) adapters and prioritize them for patching.

Patch Information

The fix is available in the upstream kernel stable tree. Refer to the Kernel Git Commit Update (d00e98977ef5), Kernel Git Commit Update (9ab6a9950f15), and Kernel Git Commit Update (2747328ba271). The patch adds helper functions to determine bp->tx_nr_rings and bp->tx_nr_rings_per_tc and scales TX rings by bp->num_tc throughout the affected code paths.

Workarounds

Avoid configuring multiple traffic classes on interfaces backed by the bnxt_en driver on unpatched 6.17 release-candidate kernels.
Downgrade to a stable Linux kernel release that does not contain the regression until patched builds are deployed.
Restrict administrative access to network interface configuration through role-based access control and sudo policy hardening.

bash

# Verify the running kernel and bnxt_en module status
uname -r
lsmod | grep bnxt_en
modinfo bnxt_en | grep -E 'version|filename'

# List Broadcom NetXtreme adapters and current TC configuration
lspci -nn | grep -i broadcom
for iface in $(ls /sys/class/net); do
    tc qdisc show dev "$iface"
done