linux-cve-announce - CVE-2025-68770: bnxt_en: Fix XDP

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <2026011357-CVE-2025-68770-6464@gregkh>
Date: Tue, 13 Jan 2026 16:28:56 +0100
From: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
To: linux-cve-announce@...r.kernel.org
Cc: Greg Kroah-Hartman <gregkh@...nel.org>
Subject: CVE-2025-68770: bnxt_en: Fix XDP_TX path

From: Greg Kroah-Hartman <gregkh@...nel.org>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

bnxt_en: Fix XDP_TX path

For XDP_TX action in bnxt_rx_xdp(), clearing of the event flags is not
correct.  __bnxt_poll_work() -> bnxt_rx_pkt() -> bnxt_rx_xdp() may be
looping within NAPI and some event flags may be set in earlier
iterations.  In particular, if BNXT_TX_EVENT is set earlier indicating
some XDP_TX packets are ready and pending, it will be cleared if it is
XDP_TX action again.  Normally, we will set BNXT_TX_EVENT again when we
successfully call __bnxt_xmit_xdp().  But if the TX ring has no more
room, the flag will not be set.  This will cause the TX producer to be
ahead but the driver will not hit the TX doorbell.

For multi-buf XDP_TX, there is no need to clear the event flags and set
BNXT_AGG_EVENT.  The BNXT_AGG_EVENT flag should have been set earlier in
bnxt_rx_pkt().

The visible symptom of this is that the RX ring associated with the
TX XDP ring will eventually become empty and all packets will be dropped.
Because this condition will cause the driver to not refill the RX ring
seeing that the TX ring has forever pending XDP_TX packets.

The fix is to only clear BNXT_RX_EVENT when we have successfully
called __bnxt_xmit_xdp().

The Linux kernel CVE team has assigned CVE-2025-68770 to this issue.

Affected and fixed versions
===========================

	Issue introduced in 6.8 with commit 7f0a168b0441ef7fd6b46563efb2706c58ac2a4c and fixed in 6.12.64 with commit 4b83902a1e67ff327ab5c6c65021a03e72c081d6
	Issue introduced in 6.8 with commit 7f0a168b0441ef7fd6b46563efb2706c58ac2a4c and fixed in 6.18.3 with commit f17e0c1208485b24d61271bc1ddc8f2087e71561
	Issue introduced in 6.8 with commit 7f0a168b0441ef7fd6b46563efb2706c58ac2a4c and fixed in 6.19-rc2 with commit 0373d5c387f24de749cc22e694a14b3a7c7eb515

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2025-68770
will be updated if fixes are backported, please check that for the most
up to date information about this issue.

Affected files
==============

The file(s) affected by this issue are:
	drivers/net/ethernet/broadcom/bnxt/bnxt_xdp.c

Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/4b83902a1e67ff327ab5c6c65021a03e72c081d6
	https://git.kernel.org/stable/c/f17e0c1208485b24d61271bc1ddc8f2087e71561
	https://git.kernel.org/stable/c/0373d5c387f24de749cc22e694a14b3a7c7eb515