Vulnerability-Lookup

CVE-2025-68770 (GCVE-0-2025-68770)

Vulnerability from cvelistv5 – Published: 2026-01-13 15:28 – Updated: 2026-01-13 15:28

Title

bnxt_en: Fix XDP_TX path

Summary

In the Linux kernel, the following vulnerability has been resolved: bnxt_en: Fix XDP_TX path For XDP_TX action in bnxt_rx_xdp(), clearing of the event flags is not correct. __bnxt_poll_work() -> bnxt_rx_pkt() -> bnxt_rx_xdp() may be looping within NAPI and some event flags may be set in earlier iterations. In particular, if BNXT_TX_EVENT is set earlier indicating some XDP_TX packets are ready and pending, it will be cleared if it is XDP_TX action again. Normally, we will set BNXT_TX_EVENT again when we successfully call __bnxt_xmit_xdp(). But if the TX ring has no more room, the flag will not be set. This will cause the TX producer to be ahead but the driver will not hit the TX doorbell. For multi-buf XDP_TX, there is no need to clear the event flags and set BNXT_AGG_EVENT. The BNXT_AGG_EVENT flag should have been set earlier in bnxt_rx_pkt(). The visible symptom of this is that the RX ring associated with the TX XDP ring will eventually become empty and all packets will be dropped. Because this condition will cause the driver to not refill the RX ring seeing that the TX ring has forever pending XDP_TX packets. The fix is to only clear BNXT_RX_EVENT when we have successfully called __bnxt_xmit_xdp().

Severity ?

No CVSS data available.

Assigner

Linux

References

URL

Tags

	https://git.kernel.org/stable/c/4b83902a1e67ff327…
	https://git.kernel.org/stable/c/f17e0c1208485b24d…
	https://git.kernel.org/stable/c/0373d5c387f24de74…

Impacted products

Vendor

Product

Version

Linux

Affected: 7f0a168b0441ef7fd6b46563efb2706c58ac2a4c , < 4b83902a1e67ff327ab5c6c65021a03e72c081d6 (git)
Affected: 7f0a168b0441ef7fd6b46563efb2706c58ac2a4c , < f17e0c1208485b24d61271bc1ddc8f2087e71561 (git)
Affected: 7f0a168b0441ef7fd6b46563efb2706c58ac2a4c , < 0373d5c387f24de749cc22e694a14b3a7c7eb515 (git)

Linux

Affected: 6.8
Unaffected: 0 , < 6.8 (semver)
Unaffected: 6.12.64 , ≤ 6.12.* (semver)
Unaffected: 6.18.3 , ≤ 6.18.* (semver)
Unaffected: 6.19-rc2 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/broadcom/bnxt/bnxt_xdp.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "4b83902a1e67ff327ab5c6c65021a03e72c081d6",
              "status": "affected",
              "version": "7f0a168b0441ef7fd6b46563efb2706c58ac2a4c",
              "versionType": "git"
            },
            {
              "lessThan": "f17e0c1208485b24d61271bc1ddc8f2087e71561",
              "status": "affected",
              "version": "7f0a168b0441ef7fd6b46563efb2706c58ac2a4c",
              "versionType": "git"
            },
            {
              "lessThan": "0373d5c387f24de749cc22e694a14b3a7c7eb515",
              "status": "affected",
              "version": "7f0a168b0441ef7fd6b46563efb2706c58ac2a4c",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/broadcom/bnxt/bnxt_xdp.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.8"
            },
            {
              "lessThan": "6.8",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.64",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.19-rc2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.64",
                  "versionStartIncluding": "6.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.3",
                  "versionStartIncluding": "6.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19-rc2",
                  "versionStartIncluding": "6.8",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbnxt_en: Fix XDP_TX path\n\nFor XDP_TX action in bnxt_rx_xdp(), clearing of the event flags is not\ncorrect.  __bnxt_poll_work() -\u003e bnxt_rx_pkt() -\u003e bnxt_rx_xdp() may be\nlooping within NAPI and some event flags may be set in earlier\niterations.  In particular, if BNXT_TX_EVENT is set earlier indicating\nsome XDP_TX packets are ready and pending, it will be cleared if it is\nXDP_TX action again.  Normally, we will set BNXT_TX_EVENT again when we\nsuccessfully call __bnxt_xmit_xdp().  But if the TX ring has no more\nroom, the flag will not be set.  This will cause the TX producer to be\nahead but the driver will not hit the TX doorbell.\n\nFor multi-buf XDP_TX, there is no need to clear the event flags and set\nBNXT_AGG_EVENT.  The BNXT_AGG_EVENT flag should have been set earlier in\nbnxt_rx_pkt().\n\nThe visible symptom of this is that the RX ring associated with the\nTX XDP ring will eventually become empty and all packets will be dropped.\nBecause this condition will cause the driver to not refill the RX ring\nseeing that the TX ring has forever pending XDP_TX packets.\n\nThe fix is to only clear BNXT_RX_EVENT when we have successfully\ncalled __bnxt_xmit_xdp()."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-01-13T15:28:48.604Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/4b83902a1e67ff327ab5c6c65021a03e72c081d6"
        },
        {
          "url": "https://git.kernel.org/stable/c/f17e0c1208485b24d61271bc1ddc8f2087e71561"
        },
        {
          "url": "https://git.kernel.org/stable/c/0373d5c387f24de749cc22e694a14b3a7c7eb515"
        }
      ],
      "title": "bnxt_en: Fix XDP_TX path",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-68770",
    "datePublished": "2026-01-13T15:28:48.604Z",
    "dateReserved": "2025-12-24T10:30:51.035Z",
    "dateUpdated": "2026-01-13T15:28:48.604Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-68770\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-01-13T16:15:56.473\",\"lastModified\":\"2026-01-14T16:26:00.933\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nbnxt_en: Fix XDP_TX path\\n\\nFor XDP_TX action in bnxt_rx_xdp(), clearing of the event flags is not\\ncorrect.  __bnxt_poll_work() -\u003e bnxt_rx_pkt() -\u003e bnxt_rx_xdp() may be\\nlooping within NAPI and some event flags may be set in earlier\\niterations.  In particular, if BNXT_TX_EVENT is set earlier indicating\\nsome XDP_TX packets are ready and pending, it will be cleared if it is\\nXDP_TX action again.  Normally, we will set BNXT_TX_EVENT again when we\\nsuccessfully call __bnxt_xmit_xdp().  But if the TX ring has no more\\nroom, the flag will not be set.  This will cause the TX producer to be\\nahead but the driver will not hit the TX doorbell.\\n\\nFor multi-buf XDP_TX, there is no need to clear the event flags and set\\nBNXT_AGG_EVENT.  The BNXT_AGG_EVENT flag should have been set earlier in\\nbnxt_rx_pkt().\\n\\nThe visible symptom of this is that the RX ring associated with the\\nTX XDP ring will eventually become empty and all packets will be dropped.\\nBecause this condition will cause the driver to not refill the RX ring\\nseeing that the TX ring has forever pending XDP_TX packets.\\n\\nThe fix is to only clear BNXT_RX_EVENT when we have successfully\\ncalled __bnxt_xmit_xdp().\"}],\"metrics\":{},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/0373d5c387f24de749cc22e694a14b3a7c7eb515\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/4b83902a1e67ff327ab5c6c65021a03e72c081d6\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/f17e0c1208485b24d61271bc1ddc8f2087e71561\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}"
  }
}

FKIE_CVE-2025-68770

Vulnerability from fkie_nvd - Published: 2026-01-13 16:15 - Updated: 2026-01-14 16:26

Severity ?

Summary

References

	URL	Tags
	416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/0373d5c387f24de749cc22e694a14b3a7c7eb515
	416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/4b83902a1e67ff327ab5c6c65021a03e72c081d6
	416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/f17e0c1208485b24d61271bc1ddc8f2087e71561

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbnxt_en: Fix XDP_TX path\n\nFor XDP_TX action in bnxt_rx_xdp(), clearing of the event flags is not\ncorrect.  __bnxt_poll_work() -\u003e bnxt_rx_pkt() -\u003e bnxt_rx_xdp() may be\nlooping within NAPI and some event flags may be set in earlier\niterations.  In particular, if BNXT_TX_EVENT is set earlier indicating\nsome XDP_TX packets are ready and pending, it will be cleared if it is\nXDP_TX action again.  Normally, we will set BNXT_TX_EVENT again when we\nsuccessfully call __bnxt_xmit_xdp().  But if the TX ring has no more\nroom, the flag will not be set.  This will cause the TX producer to be\nahead but the driver will not hit the TX doorbell.\n\nFor multi-buf XDP_TX, there is no need to clear the event flags and set\nBNXT_AGG_EVENT.  The BNXT_AGG_EVENT flag should have been set earlier in\nbnxt_rx_pkt().\n\nThe visible symptom of this is that the RX ring associated with the\nTX XDP ring will eventually become empty and all packets will be dropped.\nBecause this condition will cause the driver to not refill the RX ring\nseeing that the TX ring has forever pending XDP_TX packets.\n\nThe fix is to only clear BNXT_RX_EVENT when we have successfully\ncalled __bnxt_xmit_xdp()."
    }
  ],
  "id": "CVE-2025-68770",
  "lastModified": "2026-01-14T16:26:00.933",
  "metrics": {},
  "published": "2026-01-13T16:15:56.473",
  "references": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/0373d5c387f24de749cc22e694a14b3a7c7eb515"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/4b83902a1e67ff327ab5c6c65021a03e72c081d6"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/f17e0c1208485b24d61271bc1ddc8f2087e71561"
    }
  ],
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
  "vulnStatus": "Awaiting Analysis"
}

GHSA-J6RG-WXJC-PXJ8

Vulnerability from github – Published: 2026-01-13 18:31 – Updated: 2026-01-13 18:31

Details

In the Linux kernel, the following vulnerability has been resolved:

bnxt_en: Fix XDP_TX path

For XDP_TX action in bnxt_rx_xdp(), clearing of the event flags is not correct. __bnxt_poll_work() -> bnxt_rx_pkt() -> bnxt_rx_xdp() may be looping within NAPI and some event flags may be set in earlier iterations. In particular, if BNXT_TX_EVENT is set earlier indicating some XDP_TX packets are ready and pending, it will be cleared if it is XDP_TX action again. Normally, we will set BNXT_TX_EVENT again when we successfully call __bnxt_xmit_xdp(). But if the TX ring has no more room, the flag will not be set. This will cause the TX producer to be ahead but the driver will not hit the TX doorbell.

For multi-buf XDP_TX, there is no need to clear the event flags and set BNXT_AGG_EVENT. The BNXT_AGG_EVENT flag should have been set earlier in bnxt_rx_pkt().

The visible symptom of this is that the RX ring associated with the TX XDP ring will eventually become empty and all packets will be dropped. Because this condition will cause the driver to not refill the RX ring seeing that the TX ring has forever pending XDP_TX packets.

The fix is to only clear BNXT_RX_EVENT when we have successfully called __bnxt_xmit_xdp().

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2025-68770"
  ],
  "database_specific": {
    "cwe_ids": [],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-01-13T16:15:56Z",
    "severity": null
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nbnxt_en: Fix XDP_TX path\n\nFor XDP_TX action in bnxt_rx_xdp(), clearing of the event flags is not\ncorrect.  __bnxt_poll_work() -\u003e bnxt_rx_pkt() -\u003e bnxt_rx_xdp() may be\nlooping within NAPI and some event flags may be set in earlier\niterations.  In particular, if BNXT_TX_EVENT is set earlier indicating\nsome XDP_TX packets are ready and pending, it will be cleared if it is\nXDP_TX action again.  Normally, we will set BNXT_TX_EVENT again when we\nsuccessfully call __bnxt_xmit_xdp().  But if the TX ring has no more\nroom, the flag will not be set.  This will cause the TX producer to be\nahead but the driver will not hit the TX doorbell.\n\nFor multi-buf XDP_TX, there is no need to clear the event flags and set\nBNXT_AGG_EVENT.  The BNXT_AGG_EVENT flag should have been set earlier in\nbnxt_rx_pkt().\n\nThe visible symptom of this is that the RX ring associated with the\nTX XDP ring will eventually become empty and all packets will be dropped.\nBecause this condition will cause the driver to not refill the RX ring\nseeing that the TX ring has forever pending XDP_TX packets.\n\nThe fix is to only clear BNXT_RX_EVENT when we have successfully\ncalled __bnxt_xmit_xdp().",
  "id": "GHSA-j6rg-wxjc-pxj8",
  "modified": "2026-01-13T18:31:03Z",
  "published": "2026-01-13T18:31:03Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-68770"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/0373d5c387f24de749cc22e694a14b3a7c7eb515"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/4b83902a1e67ff327ab5c6c65021a03e72c081d6"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/f17e0c1208485b24d61271bc1ddc8f2087e71561"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CVE-2025-68770 (GCVE-0-2025-68770)

FKIE_CVE-2025-68770

GHSA-J6RG-WXJC-PXJ8

Tags

Sightings

Nomenclature