CVE-2026-31395: Linux Kernel Buffer Overflow Vulnerability

CVE-2026-31395 Overview

CVE-2026-31395 is an out-of-bounds access vulnerability in the Linux kernel's bnxt_en network driver. The flaw exists in the ASYNC_EVENT_CMPL_EVENT_ID_DBG_BUF_PRODUCER handler within the bnxt_async_event_process() function, where a firmware-supplied type field is used directly as an array index without proper bounds validation. This allows a malicious or compromised network interface card (NIC) to trigger kernel heap memory corruption or system crashes.

Critical Impact

A compromised or malicious NIC can supply arbitrary values causing out-of-bounds kernel heap access, potentially leading to memory corruption, privilege escalation, or system crashes.

Affected Products

• Linux kernel with bnxt_en Broadcom NetXtreme network driver
• Systems using Broadcom NetXtreme NICs with vulnerable kernel versions

Discovery Timeline

• 2026-04-03 - CVE CVE-2026-31395 published to NVD
• 2026-04-07 - Last updated in NVD database

Technical Details for CVE-2026-31395

Vulnerability Analysis

The vulnerability resides in the asynchronous event processing code path of the bnxt_en driver, which handles communication between the Linux kernel and Broadcom NetXtreme network adapters. The ASYNC_EVENT_CMPL_EVENT_ID_DBG_BUF_PRODUCER event handler extracts a type field from DMA-mapped completion ring memory—a region that the NIC writes directly into host RAM.

The type field is a 16-bit value, meaning it can range from 0 to 65535. However, the bp->bs_trace[] array is significantly smaller, only accommodating the defined firmware trace types (0x0 through 0xc). When an attacker-controlled or malicious NIC firmware supplies a type value exceeding the array bounds, the code accesses memory outside the allocated buffer.

The subsequent call to bnxt_bs_trace_check_wrap() compounds the issue by dereferencing bs_trace->magic_byte and writing to bs_trace->last_offset and bs_trace->wrapped at the out-of-bounds memory location. This results in arbitrary read/write primitives within kernel heap memory.

Root Cause

The root cause is missing input validation on the firmware-supplied type field before using it as an array index. The driver implicitly trusted data from the NIC firmware without verifying that the index falls within the valid range of the bp->bs_trace[] array. Since the NIC directly writes to DMA-mapped memory regions in host RAM, a compromised or malicious device can inject arbitrary values that the driver processes without sanitization.

Attack Vector

The attack requires physical access to install a malicious NIC or the ability to compromise existing NIC firmware. Once a compromised NIC is present in the system:

1. The NIC writes a malicious completion event to the DMA-mapped completion ring in host memory
2. The malicious event contains a type field with a value outside the valid range (0-12)
3. When the kernel processes this event via bnxt_async_event_process(), it uses the malicious type value as an index into bp->bs_trace[]
4. This causes an out-of-bounds memory access into kernel heap
5. The bnxt_bs_trace_check_wrap() function then reads from and writes to this out-of-bounds location, enabling memory corruption

The fix introduces the BNXT_TRACE_MAX constant (defined as DBG_LOG_BUFFER_FLUSH_REQ_TYPE_ERR_QPC_TRACE + 1) and validates that the type value falls within bounds before indexing into the array.

Detection Methods for CVE-2026-31395

Indicators of Compromise

• Unexpected kernel panics or crashes related to bnxt_en driver operations
• Memory corruption errors or KASAN (Kernel Address Sanitizer) reports involving bnxt_async_event_process()
• Unusual debug buffer producer events in kernel logs from Broadcom network adapters
• System instability coinciding with network adapter activity

Detection Strategies

• Enable KASAN (Kernel Address Sanitizer) to detect out-of-bounds memory accesses in kernel modules
• Monitor kernel logs for bnxt_en driver errors, particularly those related to async event processing
• Deploy endpoint detection rules that alert on kernel crashes associated with network driver subsystems
• Audit firmware versions on Broadcom NetXtreme NICs for known vulnerabilities or unauthorized modifications

Monitoring Recommendations

• Implement kernel crash dump analysis to identify exploitation attempts targeting the bnxt_en driver
• Monitor for unusual patterns in NIC DMA activity or completion ring events
• Track driver module loading and firmware update events for Broadcom network adapters
• Enable kernel ftrace or eBPF tracing on bnxt_async_event_process() function calls in sensitive environments

How to Mitigate CVE-2026-31395

Immediate Actions Required

• Apply the latest kernel patches that include the bounds check fix for bnxt_en driver
• Review and update NIC firmware to vendor-approved versions on all systems with Broadcom NetXtreme adapters
• Consider disabling or replacing potentially compromised network adapters until patches are applied
• Restrict physical access to servers to prevent installation of malicious hardware

Patch Information

The Linux kernel maintainers have released patches to address this vulnerability. The fix adds bounds validation to ensure the firmware-supplied type field does not exceed BNXT_TRACE_MAX before indexing into the bp->bs_trace[] array.

Patches are available from the following kernel git commits:

• Kernel Git Commit 19aa416
• Kernel Git Commit 64dcbde
• Kernel Git Commit b7c7a27

Update to a kernel version containing these fixes or apply the patches directly to your kernel source.

Workarounds

• If patching is not immediately possible, consider using alternative network drivers or NICs that do not use the bnxt_en driver
• Implement strict hardware inventory controls to detect unauthorized NIC installations
• Blacklist the bnxt_en module if Broadcom NetXtreme adapters are not required in your environment
• Enable IOMMU/VT-d to provide additional isolation for DMA operations from potentially malicious devices

# Blacklist bnxt_en driver if not needed (temporary workaround)
echo "blacklist bnxt_en" >> /etc/modprobe.d/blacklist-bnxt.conf
update-initramfs -u

# Verify current kernel version and check if patches are applied
uname -r
cat /proc/version