CVE-2025-68770
- Source
- https://cve.org/CVERecord?id=CVE-2025-68770
- Import Source
- https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2025-68770.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/CVE-2025-68770
- Downstream
- Published
- 2026-01-13T15:28:48.604Z
- Modified
- 2026-02-09T19:35:55.426658Z
- Summary
- bnxt_en: Fix XDP_TX path
- Details
-
In the Linux kernel, the following vulnerability has been resolved:
bnxten: Fix XDPTX path
For XDPTX action in bnxtrxxdp(), clearing of the event flags is not correct. _bnxtpollwork() -> bnxtrxpkt() -> bnxtrxxdp() may be looping within NAPI and some event flags may be set in earlier iterations. In particular, if BNXTTXEVENT is set earlier indicating some XDPTX packets are ready and pending, it will be cleared if it is XDPTX action again. Normally, we will set BNXTTXEVENT again when we successfully call _bnxtxmit_xdp(). But if the TX ring has no more room, the flag will not be set. This will cause the TX producer to be ahead but the driver will not hit the TX doorbell.
For multi-buf XDPTX, there is no need to clear the event flags and set BNXTAGGEVENT. The BNXTAGGEVENT flag should have been set earlier in bnxtrx_pkt().
The visible symptom of this is that the RX ring associated with the TX XDP ring will eventually become empty and all packets will be dropped. Because this condition will cause the driver to not refill the RX ring seeing that the TX ring has forever pending XDP_TX packets.
The fix is to only clear BNXTRXEVENT when we have successfully called _bnxtxmit_xdp().
- Database specific
{ "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/68xxx/CVE-2025-68770.json", "cna_assigner": "Linux" }- References
-
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- https://git.kernel.org/stable/c/0373d5c387f24de749cc22e694a14b3a7c7eb515
- https://git.kernel.org/stable/c/4b83902a1e67ff327ab5c6c65021a03e72c081d6
- https://git.kernel.org/stable/c/f17e0c1208485b24d61271bc1ddc8f2087e71561
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/68xxx/CVE-2025-68770.json
- https://nvd.nist.gov/vuln/detail/CVE-2025-68770
Affected packages
Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Affected ranges
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introduced7f0a168b0441ef7fd6b46563efb2706c58ac2a4cFixed4b83902a1e67ff327ab5c6c65021a03e72c081d6Fixedf17e0c1208485b24d61271bc1ddc8f2087e71561Fixed0373d5c387f24de749cc22e694a14b3a7c7eb515