In the Linux kernel, the following vulnerability has been resolved:
be2net: pass wrb_params in case of OS2BMC
beinsertvlaninpkt() is called with the wrbparams argument being NULL at besendpktto_bmc() call site. This may lead to dereferencing a NULL pointer when processing a workaround for specific packet, as commit bc0c3405abbb ("be2net: fix a Tx stall bug caused by a specific ipv6 packet") states.
The correct way would be to pass the wrbparams from bexmit().
{
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/40xxx/CVE-2025-40264.json",
"cna_assigner": "Linux"
}