CVE-2025-37911

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-37911", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2025-04-16T04:51:23.967Z", "datePublished": "2025-05-20T15:21:43.278Z", "dateUpdated": "2026-10-15T21:52:02.730Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:58:15.426Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbnxt_en: Fix out-of-bound memcpy() during ethtool -w\n\nWhen retrieving the FW coredump using ethtool, it can sometimes cause\nmemory corruption:\n\nBUG: KFENCE: memory corruption in __bnxt_get_coredump+0x3ef/0x670 [bnxt_en]\nCorrupted memory at 0x000000008f0f30e8 [ ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ] (in kfence-#45):\n__bnxt_get_coredump+0x3ef/0x670 [bnxt_en]\nethtool_get_dump_data+0xdc/0x1a0\n__dev_ethtool+0xa1e/0x1af0\ndev_ethtool+0xa8/0x170\ndev_ioctl+0x1b5/0x580\nsock_do_ioctl+0xab/0xf0\nsock_ioctl+0x1ce/0x2e0\n__x64_sys_ioctl+0x87/0xc0\ndo_syscall_64+0x5c/0xf0\nentry_SYSCALL_64_after_hwframe+0x78/0x80\n\n...\n\nThis happens when copying the coredump segment list in\nbnxt_hwrm_dbg_dma_data() with the HWRM_DBG_COREDUMP_LIST FW command.\nThe info->dest_buf buffer is allocated based on the number of coredump\nsegments returned by the FW. The segment list is then DMA'ed by\nthe FW and the length of the DMA is returned by FW. The driver then\ncopies this DMA'ed segment list to info->dest_buf.\n\nIn some cases, this DMA length may exceed the info->dest_buf length\nand cause the above BUG condition. Fix it by capping the copy\nlength to not exceed the length of info->dest_buf. The extra\nDMA data contains no useful information.\n\nThis code path is shared for the HWRM_DBG_COREDUMP_LIST and the\nHWRM_DBG_COREDUMP_RETRIEVE FW commands. The buffering is different\nfor these 2 FW commands. To simplify the logic, we need to move\nthe line to adjust the buffer length for HWRM_DBG_COREDUMP_RETRIEVE\nup, so that the new check to cap the copy length will work for both\ncommands."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - The bug is reached through the ETHTOOL_GET_DUMP_DATA ioctl on a socket (sock_ioctl \u2192 dev_ioctl \u2192 dev_ethtool \u2192 ethtool_get_dump_data \u2192 bnxt_get_dump_data), which requires local system access; there is no remote or adjacent-network path into bnxt_hwrm_dbg_dma_data().\nAC:L - On an affected bnxt_en adapter the attacker simply issues `ethtool -w` repeatedly and the firmware-reported DMA length deterministically exceeds the kmalloc(segs * 16) coredump-list buffer, so the out-of-bounds memcpy() is triggered reliably with no race to win and no memory layout the attacker must guess.\nPR:L - __dev_ethtool() gates ETHTOOL_GET_DUMP_DATA behind ns_capable(net->user_ns, CAP_NET_ADMIN), which is namespace-relative rather than real root \u2014 an unprivileged user who is namespace-root over a net namespace holding a bnxt netdev (e.g. an SR-IOV VF handed to a container, a very common deployment for these Broadcom NICs in cloud/Kubernetes hosts) satisfies it, so basic local user privileges suffice.\nUI:N - The attacker triggers the coredump retrieval entirely on their own via the ioctl; no administrator or other victim needs to perform any action.\nS:U - The heap corruption occurs in kernel slab memory within the same security authority as the kernel itself; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - The unchecked memcpy() overflows a small kmalloc'd slab object with up to ~2KB of firmware data (and can also read past the 2048-byte DMA slice when the FW-reported len is larger), and such slab corruption of adjacent objects is a general primitive that can be steered into kernel information disclosure.\nI:H - This is a heap out-of-bounds write \u2014 memcpy(info->dest_buf + off, dma_buf, len) with len unbounded by info->dest_buf_size (the guard against BNXT_COREDUMP_BUF_LEN(0) underflows to a huge value and never fires for HWRM_DBG_COREDUMP_LIST) \u2014 corrupting adjacent slab objects, which is the classic basis for control-flow hijack and privilege escalation.\nA:H - The reported KFENCE splat shows real memory corruption in __bnxt_get_coredump(); overflowing neighbouring slab objects readily produces oopses and kernel panics, and the attacker can repeat the ioctl at will."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/net/ethernet/broadcom/bnxt/bnxt_coredump.c"], "versions": [{"version": "c74751f4c39232c31214ec6a3bc1c7e62f5c728b", "lessThan": "69b10dd23ab826d0c7f2d9ab311842251978d0c1", "status": "affected", "versionType": "git"}, {"version": "c74751f4c39232c31214ec6a3bc1c7e62f5c728b", "lessThan": "43292b83424158fa6ec458799f3cb9c54d18c484", "status": "affected", "versionType": "git"}, {"version": "c74751f4c39232c31214ec6a3bc1c7e62f5c728b", "lessThan": "4d69864915a3a052538e4ba76cd6fd77cfc64ebe", "status": "affected", "versionType": "git"}, {"version": "c74751f4c39232c31214ec6a3bc1c7e62f5c728b", "lessThan": "44807af79efd0d78fa36383dd865ddfe7992c0a6", "status": "affected", "versionType": "git"}, {"version": "c74751f4c39232c31214ec6a3bc1c7e62f5c728b", "lessThan": "44d81a9ebf0cad92512e0ffdf7412bfe20db66ec", "status": "affected", "versionType": "git"}, {"version": "c74751f4c39232c31214ec6a3bc1c7e62f5c728b", "lessThan": "6b87bd94f34370bbf1dfa59352bed8efab5bf419", "status": "affected", "versionType": "git"}, {"version": "4bf973a1f84aefb64750bdb3afe72d54de3199d7", "status": "affected", "versionType": "git"}, {"version": "a76837dd731b68cc3b5690470bc9efa2a8e3801a", "status": "affected", "versionType": "git"}, {"version": "4.19.95", "lessThan": "4.20", "status": "affected", "versionType": "semver"}, {"version": "5.4.8", "lessThan": "5.5", "status": "affected", "versionType": "semver"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/net/ethernet/broadcom/bnxt/bnxt_coredump.c"], "versions": [{"version": "5.5", "status": "affected"}, {"version": "0", "lessThan": "5.5", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.182", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.138", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.90", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.28", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.14.6", "lessThanOrEqual": "6.14.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.15", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.5", "versionEndExcluding": "5.15.182"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.5", "versionEndExcluding": "6.1.138"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.5", "versionEndExcluding": "6.6.90"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.5", "versionEndExcluding": "6.12.28"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.5", "versionEndExcluding": "6.14.6"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.5", "versionEndExcluding": "6.15"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.19.95"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.4.8"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/69b10dd23ab826d0c7f2d9ab311842251978d0c1"}, {"url": "https://git.kernel.org/stable/c/43292b83424158fa6ec458799f3cb9c54d18c484"}, {"url": "https://git.kernel.org/stable/c/4d69864915a3a052538e4ba76cd6fd77cfc64ebe"}, {"url": "https://git.kernel.org/stable/c/44807af79efd0d78fa36383dd865ddfe7992c0a6"}, {"url": "https://git.kernel.org/stable/c/44d81a9ebf0cad92512e0ffdf7412bfe20db66ec"}, {"url": "https://git.kernel.org/stable/c/6b87bd94f34370bbf1dfa59352bed8efab5bf419"}], "title": "bnxt_en: Fix out-of-bound memcpy() during ethtool -w", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"title": "CVE Program Container", "references": [{"url": "https://lists.debian.org/debian-lts-announce/2025/08/msg00010.html"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-11-03T19:57:12.296Z"}}, {"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-37911", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-15T21:45:50.402832Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-15T21:52:02.730Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://lists.debian.org/debian-lts-announce/2025/08/msg00010.html"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-11-03T19:57:12.296Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-37911", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-15T21:45:50.402832Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-15T21:45:50.874Z"}}], "cna": {"title": "bnxt_en: Fix out-of-bound memcpy() during ethtool -w", "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 7.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}, "scenarios": [{"lang": "en", "value": "AV:L - The bug is reached through the ETHTOOL_GET_DUMP_DATA ioctl on a socket (sock_ioctl \u2192 dev_ioctl \u2192 dev_ethtool \u2192 ethtool_get_dump_data \u2192 bnxt_get_dump_data), which requires local system access; there is no remote or adjacent-network path into bnxt_hwrm_dbg_dma_data().\nAC:L - On an affected bnxt_en adapter the attacker simply issues `ethtool -w` repeatedly and the firmware-reported DMA length deterministically exceeds the kmalloc(segs * 16) coredump-list buffer, so the out-of-bounds memcpy() is triggered reliably with no race to win and no memory layout the attacker must guess.\nPR:L - __dev_ethtool() gates ETHTOOL_GET_DUMP_DATA behind ns_capable(net->user_ns, CAP_NET_ADMIN), which is namespace-relative rather than real root \u2014 an unprivileged user who is namespace-root over a net namespace holding a bnxt netdev (e.g. an SR-IOV VF handed to a container, a very common deployment for these Broadcom NICs in cloud/Kubernetes hosts) satisfies it, so basic local user privileges suffice.\nUI:N - The attacker triggers the coredump retrieval entirely on their own via the ioctl; no administrator or other victim needs to perform any action.\nS:U - The heap corruption occurs in kernel slab memory within the same security authority as the kernel itself; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - The unchecked memcpy() overflows a small kmalloc'd slab object with up to ~2KB of firmware data (and can also read past the 2048-byte DMA slice when the FW-reported len is larger), and such slab corruption of adjacent objects is a general primitive that can be steered into kernel information disclosure.\nI:H - This is a heap out-of-bounds write \u2014 memcpy(info->dest_buf + off, dma_buf, len) with len unbounded by info->dest_buf_size (the guard against BNXT_COREDUMP_BUF_LEN(0) underflows to a huge value and never fires for HWRM_DBG_COREDUMP_LIST) \u2014 corrupting adjacent slab objects, which is the classic basis for control-flow hijack and privilege escalation.\nA:H - The reported KFENCE splat shows real memory corruption in __bnxt_get_coredump(); overflowing neighbouring slab objects readily produces oopses and kernel panics, and the attacker can repeat the ioctl at will."}]}], "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "c74751f4c39232c31214ec6a3bc1c7e62f5c728b", "lessThan": "69b10dd23ab826d0c7f2d9ab311842251978d0c1", "versionType": "git"}, {"status": "affected", "version": "c74751f4c39232c31214ec6a3bc1c7e62f5c728b", "lessThan": "43292b83424158fa6ec458799f3cb9c54d18c484", "versionType": "git"}, {"status": "affected", "version": "c74751f4c39232c31214ec6a3bc1c7e62f5c728b", "lessThan": "4d69864915a3a052538e4ba76cd6fd77cfc64ebe", "versionType": "git"}, {"status": "affected", "version": "c74751f4c39232c31214ec6a3bc1c7e62f5c728b", "lessThan": "44807af79efd0d78fa36383dd865ddfe7992c0a6", "versionType": "git"}, {"status": "affected", "version": "c74751f4c39232c31214ec6a3bc1c7e62f5c728b", "lessThan": "44d81a9ebf0cad92512e0ffdf7412bfe20db66ec", "versionType": "git"}, {"status": "affected", "version": "c74751f4c39232c31214ec6a3bc1c7e62f5c728b", "lessThan": "6b87bd94f34370bbf1dfa59352bed8efab5bf419", "versionType": "git"}, {"status": "affected", "version": "4bf973a1f84aefb64750bdb3afe72d54de3199d7", "versionType": "git"}, {"status": "affected", "version": "a76837dd731b68cc3b5690470bc9efa2a8e3801a", "versionType": "git"}, {"status": "affected", "version": "4.19.95", "lessThan": "4.20", "versionType": "semver"}, {"status": "affected", "version": "5.4.8", "lessThan": "5.5", "versionType": "semver"}], "programFiles": ["drivers/net/ethernet/broadcom/bnxt/bnxt_coredump.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "5.5"}, {"status": "unaffected", "version": "0", "lessThan": "5.5", "versionType": "semver"}, {"status": "unaffected", "version": "5.15.182", "versionType": "semver", "lessThanOrEqual": "5.15.*"}, {"status": "unaffected", "version": "6.1.138", "versionType": "semver", "lessThanOrEqual": "6.1.*"}, {"status": "unaffected", "version": "6.6.90", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.12.28", "versionType": "semver", "lessThanOrEqual": "6.12.*"}, {"status": "unaffected", "version": "6.14.6", "versionType": "semver", "lessThanOrEqual": "6.14.*"}, {"status": "unaffected", "version": "6.15", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["drivers/net/ethernet/broadcom/bnxt/bnxt_coredump.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/69b10dd23ab826d0c7f2d9ab311842251978d0c1"}, {"url": "https://git.kernel.org/stable/c/43292b83424158fa6ec458799f3cb9c54d18c484"}, {"url": "https://git.kernel.org/stable/c/4d69864915a3a052538e4ba76cd6fd77cfc64ebe"}, {"url": "https://git.kernel.org/stable/c/44807af79efd0d78fa36383dd865ddfe7992c0a6"}, {"url": "https://git.kernel.org/stable/c/44d81a9ebf0cad92512e0ffdf7412bfe20db66ec"}, {"url": "https://git.kernel.org/stable/c/6b87bd94f34370bbf1dfa59352bed8efab5bf419"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbnxt_en: Fix out-of-bound memcpy() during ethtool -w\n\nWhen retrieving the FW coredump using ethtool, it can sometimes cause\nmemory corruption:\n\nBUG: KFENCE: memory corruption in __bnxt_get_coredump+0x3ef/0x670 [bnxt_en]\nCorrupted memory at 0x000000008f0f30e8 [ ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ] (in kfence-#45):\n__bnxt_get_coredump+0x3ef/0x670 [bnxt_en]\nethtool_get_dump_data+0xdc/0x1a0\n__dev_ethtool+0xa1e/0x1af0\ndev_ethtool+0xa8/0x170\ndev_ioctl+0x1b5/0x580\nsock_do_ioctl+0xab/0xf0\nsock_ioctl+0x1ce/0x2e0\n__x64_sys_ioctl+0x87/0xc0\ndo_syscall_64+0x5c/0xf0\nentry_SYSCALL_64_after_hwframe+0x78/0x80\n\n...\n\nThis happens when copying the coredump segment list in\nbnxt_hwrm_dbg_dma_data() with the HWRM_DBG_COREDUMP_LIST FW command.\nThe info->dest_buf buffer is allocated based on the number of coredump\nsegments returned by the FW. The segment list is then DMA'ed by\nthe FW and the length of the DMA is returned by FW. The driver then\ncopies this DMA'ed segment list to info->dest_buf.\n\nIn some cases, this DMA length may exceed the info->dest_buf length\nand cause the above BUG condition. Fix it by capping the copy\nlength to not exceed the length of info->dest_buf. The extra\nDMA data contains no useful information.\n\nThis code path is shared for the HWRM_DBG_COREDUMP_LIST and the\nHWRM_DBG_COREDUMP_RETRIEVE FW commands. The buffering is different\nfor these 2 FW commands. To simplify the logic, we need to move\nthe line to adjust the buffer length for HWRM_DBG_COREDUMP_RETRIEVE\nup, so that the new check to cap the copy length will work for both\ncommands."}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.15.182", "versionStartIncluding": "5.5"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.1.138", "versionStartIncluding": "5.5"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.6.90", "versionStartIncluding": "5.5"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.12.28", "versionStartIncluding": "5.5"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.14.6", "versionStartIncluding": "5.5"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.15", "versionStartIncluding": "5.5"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionStartIncluding": "4.19.95"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionStartIncluding": "5.4.8"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:58:15.426Z"}}}, "cveMetadata": {"cveId": "CVE-2025-37911", "state": "PUBLISHED", "dateUpdated": "2026-10-15T21:52:02.730Z", "dateReserved": "2025-04-16T04:51:23.967Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2025-05-20T15:21:43.278Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/net/ethernet/broadcom/bnxt/bnxt_coredump.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "69b10dd23ab826d0c7f2d9ab311842251978d0c1", "status": "affected", "version": "c74751f4c39232c31214ec6a3bc1c7e62f5c728b", "versionType": "git"}, {"lessThan": "43292b83424158fa6ec458799f3cb9c54d18c484", "status": "affected", "version": "c74751f4c39232c31214ec6a3bc1c7e62f5c728b", "versionType": "git"}, {"lessThan": "4d69864915a3a052538e4ba76cd6fd77cfc64ebe", "status": "affected", "version": "c74751f4c39232c31214ec6a3bc1c7e62f5c728b", "versionType": "git"}, {"lessThan": "44807af79efd0d78fa36383dd865ddfe7992c0a6", "status": "affected", "version": "c74751f4c39232c31214ec6a3bc1c7e62f5c728b", "versionType": "git"}, {"lessThan": "44d81a9ebf0cad92512e0ffdf7412bfe20db66ec", "status": "affected", "version": "c74751f4c39232c31214ec6a3bc1c7e62f5c728b", "versionType": "git"}, {"lessThan": "6b87bd94f34370bbf1dfa59352bed8efab5bf419", "status": "affected", "version": "c74751f4c39232c31214ec6a3bc1c7e62f5c728b", "versionType": "git"}, {"status": "affected", "version": "4bf973a1f84aefb64750bdb3afe72d54de3199d7", "versionType": "git"}, {"status": "affected", "version": "a76837dd731b68cc3b5690470bc9efa2a8e3801a", "versionType": "git"}, {"lessThan": "4.20", "status": "affected", "version": "4.19.95", "versionType": "semver"}, {"lessThan": "5.5", "status": "affected", "version": "5.4.8", "versionType": "semver"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/net/ethernet/broadcom/bnxt/bnxt_coredump.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "5.5"}, {"lessThan": "5.5", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.182", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.138", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.90", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.28", "versionType": "semver"}, {"lessThanOrEqual": "6.14.*", "status": "unaffected", "version": "6.14.6", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "6.15", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "F8BA967D-44E8-4797-9C66-4A688373DA1C", "versionEndExcluding": "4.20", "versionStartIncluding": "4.19.95", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "A1F70F25-EF24-41F5-84A3-EE6BF8BD9843", "versionEndExcluding": "5.5", "versionStartIncluding": "5.4.8", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "FCF2B8EB-AD17-4664-8C65-CBB793FE89DB", "versionEndExcluding": "5.15.182", "versionStartIncluding": "5.5.1", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "B6266F82-46B4-4D38-AC4A-54C92A1DFAB2", "versionEndExcluding": "6.1.138", "versionStartIncluding": "5.16", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "2BE1DB09-2D62-4C63-AF19-947300669741", "versionEndExcluding": "6.6.90", "versionStartIncluding": "6.2", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "5082CE19-0F3D-4521-AB3E-810D8255F500", "versionEndExcluding": "6.12.28", "versionStartIncluding": "6.7", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "19E5095E-5950-43EA-8E78-FC860855293F", "versionEndExcluding": "6.14.6", "versionStartIncluding": "6.13", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:5.5:-:*:*:*:*:*:*", "matchCriteriaId": "EE98F46A-F7D9-4609-B6A0-882E7F0D378C", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:5.5:rc3:*:*:*:*:*:*", "matchCriteriaId": "8C58602A-1D3D-4A07-AB88-AB5B403D3E8C", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:5.5:rc4:*:*:*:*:*:*", "matchCriteriaId": "54191273-DBF7-4AF6-8039-36DFDEBF4529", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:5.5:rc5:*:*:*:*:*:*", "matchCriteriaId": "7A986E40-065E-4807-B171-802B9460E47E", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:5.5:rc6:*:*:*:*:*:*", "matchCriteriaId": "911090B3-B2FF-4DD4-A4A4-1BEA41209886", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:5.5:rc7:*:*:*:*:*:*", "matchCriteriaId": "3444D854-CE07-4D25-827A-ECF7BB58EA2D", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.15:rc1:*:*:*:*:*:*", "matchCriteriaId": "8D465631-2980-487A-8E65-40AE2B9F8ED1", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.15:rc2:*:*:*:*:*:*", "matchCriteriaId": "4C9D071F-B28E-46EC-AC61-22B913390211", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.15:rc3:*:*:*:*:*:*", "matchCriteriaId": "13FC0DDE-E513-465E-9E81-515702D49B74", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.15:rc4:*:*:*:*:*:*", "matchCriteriaId": "8C7B5B0E-4EEB-48F5-B4CF-0935A7633845", "vulnerable": true}], "negate": false, "operator": "OR"}]}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*", "matchCriteriaId": "FA6FEEC2-9F11-4643-8827-749718254FED", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbnxt_en: Fix out-of-bound memcpy() during ethtool -w\n\nWhen retrieving the FW coredump using ethtool, it can sometimes cause\nmemory corruption:\n\nBUG: KFENCE: memory corruption in __bnxt_get_coredump+0x3ef/0x670 [bnxt_en]\nCorrupted memory at 0x000000008f0f30e8 [ ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ] (in kfence-#45):\n__bnxt_get_coredump+0x3ef/0x670 [bnxt_en]\nethtool_get_dump_data+0xdc/0x1a0\n__dev_ethtool+0xa1e/0x1af0\ndev_ethtool+0xa8/0x170\ndev_ioctl+0x1b5/0x580\nsock_do_ioctl+0xab/0xf0\nsock_ioctl+0x1ce/0x2e0\n__x64_sys_ioctl+0x87/0xc0\ndo_syscall_64+0x5c/0xf0\nentry_SYSCALL_64_after_hwframe+0x78/0x80\n\n...\n\nThis happens when copying the coredump segment list in\nbnxt_hwrm_dbg_dma_data() with the HWRM_DBG_COREDUMP_LIST FW command.\nThe info->dest_buf buffer is allocated based on the number of coredump\nsegments returned by the FW. The segment list is then DMA'ed by\nthe FW and the length of the DMA is returned by FW. The driver then\ncopies this DMA'ed segment list to info->dest_buf.\n\nIn some cases, this DMA length may exceed the info->dest_buf length\nand cause the above BUG condition. Fix it by capping the copy\nlength to not exceed the length of info->dest_buf. The extra\nDMA data contains no useful information.\n\nThis code path is shared for the HWRM_DBG_COREDUMP_LIST and the\nHWRM_DBG_COREDUMP_RETRIEVE FW commands. The buffering is different\nfor these 2 FW commands. To simplify the logic, we need to move\nthe line to adjust the buffer length for HWRM_DBG_COREDUMP_RETRIEVE\nup, so that the new check to cap the copy length will work for both\ncommands."}, {"lang": "es", "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: bnxt_en: Se corrige memcpy() fuera de los l\u00edmite durante ethtool -w Al recuperar el volcado de n\u00facleo de FW con ethtool, a veces puede causar corrupci\u00f3n de memoria: ERROR: KFENCE: corrupci\u00f3n de memoria en __bnxt_get_coredump+0x3ef/0x670 [bnxt_en] Memoria corrupta en 0x000000008f0f30e8 [ ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ] (en kfence-#45): __bnxt_get_coredump+0x3ef/0x670 [bnxt_es] ethtool_get_dump_data+0xdc/0x1a0 __dev_ethtool+0xa1e/0x1af0 dev_ethtool+0xa8/0x170 dev_ioctl+0x1b5/0x580 sock_do_ioctl+0xab/0xf0 sock_ioctl+0x1ce/0x2e0 __x64_sys_ioctl+0x87/0xc0 do_syscall_64+0x5c/0xf0 entry_SYSCALL_64_after_hwframe+0x78/0x80 ... Esto sucede al copiar la lista de segmentos del volcado de n\u00facleo en bnxt_hwrm_dbg_dma_data() con el comando de firmware HWRM_DBG_COREDUMP_LIST. El b\u00fafer info->dest_buf se asigna seg\u00fan la cantidad de segmentos de volcado de n\u00facleo devueltos por el firmware. El firmware procesa la lista de segmentos mediante DMA y devuelve su longitud. El controlador copia esta lista de segmentos procesada mediante DMA en info->dest_buf. En algunos casos, esta longitud de DMA puede superar la longitud de info->dest_buf y causar el error mencionado. Para solucionarlo, limite la longitud de la copia para que no supere la longitud de info->dest_buf. Los datos DMA adicionales no contienen informaci\u00f3n \u00fatil. Esta ruta de c\u00f3digo es compartida por los comandos de firmware HWRM_DBG_COREDUMP_LIST y HWRM_DBG_COREDUMP_RETRIEVE. El almacenamiento en b\u00fafer es diferente para estos dos comandos de firmware. Para simplificar la l\u00f3gica, necesitamos mover la l\u00ednea para ajustar la longitud del b\u00fafer para HWRM_DBG_COREDUMP_RETRIEVE hacia arriba, de modo que la nueva verificaci\u00f3n para limitar la longitud de la copia funcione para ambos comandos."}], "id": "CVE-2025-37911", "lastModified": "2026-10-15T22:18:20.400", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-37911", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-10-15T21:45:50.402832Z", "version": "2.0.3"}}]}, "published": "2025-05-20T16:15:27.610", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/43292b83424158fa6ec458799f3cb9c54d18c484"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/44807af79efd0d78fa36383dd865ddfe7992c0a6"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/44d81a9ebf0cad92512e0ffdf7412bfe20db66ec"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/4d69864915a3a052538e4ba76cd6fd77cfc64ebe"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/69b10dd23ab826d0c7f2d9ab311842251978d0c1"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/6b87bd94f34370bbf1dfa59352bed8efab5bf419"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Mailing List"], "url": "https://lists.debian.org/debian-lts-announce/2025/08/msg00010.html"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-125"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: bnxt_en: Fix out-of-bound memcpy() during ethtool -w", "id": "2367542", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2367542"}, "csaw": false, "cvss3": {"cvss3_base_score": "4.4", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "details": ["In the Linux kernel, the following vulnerability has been resolved:\nbnxt_en: Fix out-of-bound memcpy() during ethtool -w\nWhen retrieving the FW coredump using ethtool, it can sometimes cause\nmemory corruption:\nBUG: KFENCE: memory corruption in __bnxt_get_coredump+0x3ef/0x670 [bnxt_en]\nCorrupted memory at 0x000000008f0f30e8 [ ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ] (in kfence-#45):\n__bnxt_get_coredump+0x3ef/0x670 [bnxt_en]\nethtool_get_dump_data+0xdc/0x1a0\n__dev_ethtool+0xa1e/0x1af0\ndev_ethtool+0xa8/0x170\ndev_ioctl+0x1b5/0x580\nsock_do_ioctl+0xab/0xf0\nsock_ioctl+0x1ce/0x2e0\n__x64_sys_ioctl+0x87/0xc0\ndo_syscall_64+0x5c/0xf0\nentry_SYSCALL_64_after_hwframe+0x78/0x80\n...\nThis happens when copying the coredump segment list in\nbnxt_hwrm_dbg_dma_data() with the HWRM_DBG_COREDUMP_LIST FW command.\nThe info->dest_buf buffer is allocated based on the number of coredump\nsegments returned by the FW. The segment list is then DMA'ed by\nthe FW and the length of the DMA is returned by FW. The driver then\ncopies this DMA'ed segment list to info->dest_buf.\nIn some cases, this DMA length may exceed the info->dest_buf length\nand cause the above BUG condition. Fix it by capping the copy\nlength to not exceed the length of info->dest_buf. The extra\nDMA data contains no useful information.\nThis code path is shared for the HWRM_DBG_COREDUMP_LIST and the\nHWRM_DBG_COREDUMP_RETRIEVE FW commands. The buffering is different\nfor these 2 FW commands. To simplify the logic, we need to move\nthe line to adjust the buffer length for HWRM_DBG_COREDUMP_RETRIEVE\nup, so that the new check to cap the copy length will work for both\ncommands."], "name": "CVE-2025-37911", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Out of support scope", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2025-05-20T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2025-37911\nhttps://nvd.nist.gov/vuln/detail/CVE-2025-37911\nhttps://lore.kernel.org/linux-cve-announce/2025052059-CVE-2025-37911-3da7@gregkh/T"], "statement": "A memory corruption issue was identified in the bnxt_en network driver when handling ethtool -w requests for firmware core dumps. The driver failed to properly bound a memcpy() operation, potentially leading to kernel crashes if the firmware returns more data than the allocated buffer. Triggering this flaw requires local privileges (e.g., CAP_NET_ADMIN).", "threat_severity": "Low"}

{"created": "2025-06-27T09:26:51.527779+00:00", "updated": "2025-06-27T09:26:51.527827+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}