CVE-2026-31395

In the Linux kernel, the following vulnerability has been resolved:

bnxten: fix OOB access in DBGBUF_PRODUCER async event handler

The ASYNCEVENTCMPLEVENTIDDBGBUFPRODUCER handler in bnxtasynceventprocess() uses a firmware-supplied 'type' field directly as an index into bp->bs_trace[] without bounds validation.

The 'type' field is a 16-bit value extracted from DMA-mapped completion ring memory that the NIC writes directly to host RAM. A malicious or compromised NIC can supply any value from 0 to 65535, causing an out-of-bounds access into kernel heap memory.

The bnxtbstracecheckwrap() call then dereferences bstrace->magicbyte and writes to bstrace->lastoffset and bs_trace->wrapped, leading to kernel memory corruption or a crash.

Fix by adding a bounds check and defining BNXTTRACEMAX as DBGLOGBUFFERFLUSHREQTYPEERRQPCTRACE + 1 to cover all currently defined firmware trace types (0x0 through 0xc).