CVE-2025-22108 bnxt_en: Mask the bd_cnt field in the TX BD properly
An integer overflow in the bnxt_en network driver can corrupt TX buffers, leading to transmission timeouts and denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-22108?
CVE-2025-22108 is a high-severity vulnerability in Linux kernel, published on 16 Apr 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
bnxt_en: Mask the bd_cnt field in the TX BD properly
The bd_cnt field in the TX BD specifies the total number of BDs for the TX packet. The bd_cnt field has 5 bits and the maximum number supported is 32 with the value 0.
CONFIG_MAX_SKB_FRAGS can be modified and the total number of SKB fragments can approach or exceed the maximum supported by the chip. Add a macro to properly mask the bd_cnt field so that the value 32 will be properly masked and set to 0 in the bd_cnd field.
Without this patch, the out-of-range bd_cnt value will corrupt the TX BD and may cause TX timeout.
The next patch will check for values exceeding 32.
Which versions are affected by CVE-2025-22108?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2025-22108?
Apply the vendor's patch.
Is CVE-2025-22108 being exploited?
There is no known exploitation of CVE-2025-22108 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as AZL-62553, BELL-CVE-2025-22108, DEBIAN-CVE-2025-22108, GHSA-c4fx-3whg-2g7m, ROOT-OS-DEBIAN-13-CVE-2025-22108, ROOT-OS-UBUNTU-2404-CVE-2025-22108 and 1 more.