CVE-2025-21682
- Source
- https://nvd.nist.gov/vuln/detail/CVE-2025-21682
- Import Source
- https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2025-21682.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/CVE-2025-21682
- Downstream
- Related
- Published
- 2025-01-31T11:25:42Z
- Modified
- 2025-10-10T05:49:01.631534Z
- Severity
-
- 5.5 (Medium) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
- Summary
- eth: bnxt: always recalculate features after XDP clearing, fix null-deref
- Details
-
In the Linux kernel, the following vulnerability has been resolved:
eth: bnxt: always recalculate features after XDP clearing, fix null-deref
Recalculate features when XDP is detached.
Before: # ip li set dev eth0 xdp obj xdp_dummy.bpf.o sec xdp # ip li set dev eth0 xdp off # ethtool -k eth0 | grep gro rx-gro-hw: off [requested on]
After: # ip li set dev eth0 xdp obj xdp_dummy.bpf.o sec xdp # ip li set dev eth0 xdp off # ethtool -k eth0 | grep gro rx-gro-hw: on
The fact that HW-GRO doesn't get re-enabled automatically is just a minor annoyance. The real issue is that the features will randomly come back during another reconfiguration which just happens to invoke netdevupdatefeatures(). The driver doesn't handle reconfiguring two things at a time very robustly.
Starting with commit 98ba1d931f61 ("bnxten: Fix RSS logic in _bnxtreserverings()") we only reconfigure the RSS hash table if the "effective" number of Rx rings has changed. If HW-GRO is enabled "effective" number of rings is 2x what user sees. So if we are in the bad state, with HW-GRO re-enablement "pending" after XDP off, and we lower the rings by / 2 - the HW-GRO rings doing 2x and the ethtool -L doing / 2 may cancel each other out, and the:
if (oldrxrings != bp->hwresc.resvrx_rings &&
condition in _bnxtreserve_rings() will be false. The RSS map won't get updated, and we'll crash with:
BUG: kernel NULL pointer dereference, address: 0000000000000168 RIP: 0010:_bnxthwrmvnicsetrss+0x13a/0x1a0 bnxthwrmvnicrsscfgp5+0x47/0x180 _bnxtsetupvnicp5+0x58/0x110 bnxtinitnic+0xb72/0xf50 _bnxtopennic+0x40d/0xab0 bnxtopennic+0x2b/0x60 ethtoolset_channels+0x18c/0x1d0
As we try to access a freed ring.
The issue is present since XDP support was added, really, but prior to commit 98ba1d931f61 ("bnxten: Fix RSS logic in _bnxtreserverings()") it wasn't causing major issues.
- References
Affected packages
Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Affected ranges
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introduced1054aee82321483dceabbb9b9e5d6512e8fe684bFixed08831a894d18abfaabb5bbde7c2069a7fb41dd93
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introduced1054aee82321483dceabbb9b9e5d6512e8fe684bFixedf0aa6a37a3dbb40b272df5fc6db93c114688adcd