# CVE-2025-22108: bnxt_en: Mask the bd_cnt field in the TX BD properly

> An integer overflow in the bnxt_en network driver can corrupt TX buffers, leading to transmission timeouts and denial of service.

- **Severity:** High 8.6 (`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H`)
- **Exploited in the wild:** Not known
- **Login needed:** Not needed
- **Attackable:** Over the internet
- **Victim action needed:** Not needed
- **Fix available:** Yes
- **Published:** 16 Apr 2025
- **Updated:** 7 Sep 2026
- **Also known as:** AZL-62553, BELL-CVE-2025-22108, DEBIAN-CVE-2025-22108, GHSA-c4fx-3whg-2g7m, ROOT-OS-DEBIAN-13-CVE-2025-22108, ROOT-OS-UBUNTU-2404-CVE-2025-22108, UBUNTU-CVE-2025-22108

## What is CVE-2025-22108?

CVE-2025-22108 is a high-severity vulnerability in Linux kernel, published on 16 Apr 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.

### Official description

In the Linux kernel, the following vulnerability has been resolved:

bnxt_en: Mask the bd_cnt field in the TX BD properly

The bd_cnt field in the TX BD specifies the total number of BDs for
the TX packet.  The bd_cnt field has 5 bits and the maximum number
supported is 32 with the value 0.

CONFIG_MAX_SKB_FRAGS can be modified and the total number of SKB
fragments can approach or exceed the maximum supported by the chip.
Add a macro to properly mask the bd_cnt field so that the value 32
will be properly masked and set to 0 in the bd_cnd field.

Without this patch, the out-of-range bd_cnt value will corrupt the
TX BD and may cause TX timeout.

The next patch will check for values exceeding 32.

## Which versions are affected by CVE-2025-22108?

It affects 1 product.


Products: Linux kernel.

## How do I fix CVE-2025-22108?

Apply the vendor's patch.

## Is CVE-2025-22108 being exploited?

There is no known exploitation of CVE-2025-22108 in the wild and no public exploit code.

## Other vulnerabilities in Linux kernel

- [CVE-2026-53266](https://insights.sbomify.com/CVE-2026-53266/): Linux Kernel Out-of-Bounds Write (high 8.8, exploited in the wild)
- [CVE-2013-6282](https://insights.sbomify.com/CVE-2013-6282/): Linux Kernel Improper Input Validation (high 8.8, exploited in the wild)
- [CVE-2022-0185](https://insights.sbomify.com/CVE-2022-0185/): Linux Kernel Heap-Based Buffer Overflow (high 8.4, exploited in the wild)
- [CVE-2013-2094](https://insights.sbomify.com/CVE-2013-2094/): Linux Kernel Privilege Escalation (high 8.4, exploited in the wild)
- [CVE-2026-53362](https://insights.sbomify.com/CVE-2026-53362/): Linux Kernel Unspecified (high 7.8, exploited in the wild)

## Fix prompt for AI coding agents

```text
Check this codebase for CVE-2025-22108 and fix it if it is affected.

What it is: CVE-2025-22108 is a high-severity vulnerability in Linux kernel, published on 16 Apr 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Exploitation: There is no known exploitation of CVE-2025-22108 in the wild and no public exploit code.

Affected product: Linux kernel. No package-level version data is available, so check the vendor advisory linked from the reference page.

Task:
1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.
2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.
3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.
4. Run the tests and summarise what changed and why.
5. If nothing in the project is affected, say so and change nothing.

Reference: https://insights.sbomify.com/CVE-2025-22108/ (Markdown: https://insights.sbomify.com/CVE-2025-22108/index.md)
```

## Sources

- CVE record: https://www.cve.org/CVERecord?id=CVE-2025-22108
- NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-22108
- OSV: https://osv.dev/vulnerability/CVE-2025-22108

---
From sbomify Insights: https://insights.sbomify.com/CVE-2025-22108/
Summaries are generated and may contain mistakes; the official description above is the record.