CVE-2025-38439 (GCVE-0-2025-38439)
Vulnerability from cvelistv5
Published
2025-07-25 15:27
Modified
2026-08-05 12:01
Severity ?
9.8 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Summary
In the Linux kernel, the following vulnerability has been resolved: bnxt_en: Set DMA unmap len correctly for XDP_REDIRECT When transmitting an XDP_REDIRECT packet, call dma_unmap_len_set() with the proper length instead of 0. This bug triggers this warning on a system with IOMMU enabled: WARNING: CPU: 36 PID: 0 at drivers/iommu/dma-iommu.c:842 __iommu_dma_unmap+0x159/0x170 RIP: 0010:__iommu_dma_unmap+0x159/0x170 Code: a8 00 00 00 00 48 c7 45 b0 00 00 00 00 48 c7 45 c8 00 00 00 00 48 c7 45 a0 ff ff ff ff 4c 89 45 b8 4c 89 45 c0 e9 77 ff ff ff <0f> 0b e9 60 ff ff ff e8 8b bf 6a 00 66 66 2e 0f 1f 84 00 00 00 00 RSP: 0018:ff22d31181150c88 EFLAGS: 00010206 RAX: 0000000000002000 RBX: 00000000e13a0000 RCX: 0000000000000000 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 RBP: ff22d31181150cf0 R08: ff22d31181150ca8 R09: 0000000000000000 R10: 0000000000000000 R11: ff22d311d36c9d80 R12: 0000000000001000 R13: ff13544d10645010 R14: ff22d31181150c90 R15: ff13544d0b2bac00 FS: 0000000000000000(0000) GS:ff13550908a00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00005be909dacff8 CR3: 0008000173408003 CR4: 0000000000f71ef0 PKRU: 55555554 Call Trace: <IRQ> ? show_regs+0x6d/0x80 ? __warn+0x89/0x160 ? __iommu_dma_unmap+0x159/0x170 ? report_bug+0x17e/0x1b0 ? handle_bug+0x46/0x90 ? exc_invalid_op+0x18/0x80 ? asm_exc_invalid_op+0x1b/0x20 ? __iommu_dma_unmap+0x159/0x170 ? __iommu_dma_unmap+0xb3/0x170 iommu_dma_unmap_page+0x4f/0x100 dma_unmap_page_attrs+0x52/0x220 ? srso_alias_return_thunk+0x5/0xfbef5 ? xdp_return_frame+0x2e/0xd0 bnxt_tx_int_xdp+0xdf/0x440 [bnxt_en] __bnxt_poll_work_done+0x81/0x1e0 [bnxt_en] bnxt_poll+0xd3/0x1e0 [bnxt_en]
References
Impacted products
Vendor Product Version
Linux Linux Version: f18c2b77b2e4eec2313d519ba125bd6a069513cf
Version: f18c2b77b2e4eec2313d519ba125bd6a069513cf
Version: f18c2b77b2e4eec2313d519ba125bd6a069513cf
Version: f18c2b77b2e4eec2313d519ba125bd6a069513cf
Version: f18c2b77b2e4eec2313d519ba125bd6a069513cf
Version: f18c2b77b2e4eec2313d519ba125bd6a069513cf
Version: f18c2b77b2e4eec2313d519ba125bd6a069513cf
Version: f18c2b77b2e4eec2313d519ba125bd6a069513cf
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T17:38:02.718Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html"
          },
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/broadcom/bnxt/bnxt_xdp.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "e260f4d49370c85a4701d43c6d16b8c39f8b605f",
              "status": "affected",
              "version": "f18c2b77b2e4eec2313d519ba125bd6a069513cf",
              "versionType": "git"
            },
            {
              "lessThan": "16ae306602163fcb7ae83f2701b542e43c100cee",
              "status": "affected",
              "version": "f18c2b77b2e4eec2313d519ba125bd6a069513cf",
              "versionType": "git"
            },
            {
              "lessThan": "8d672a1a6bfc81fef9151925c9c0481f4acf4bec",
              "status": "affected",
              "version": "f18c2b77b2e4eec2313d519ba125bd6a069513cf",
              "versionType": "git"
            },
            {
              "lessThan": "f9eaf6d036075dc820520e1194692c0619b7297b",
              "status": "affected",
              "version": "f18c2b77b2e4eec2313d519ba125bd6a069513cf",
              "versionType": "git"
            },
            {
              "lessThan": "5909679a82cd74cf0343d9e3ddf4b6931aa7e613",
              "status": "affected",
              "version": "f18c2b77b2e4eec2313d519ba125bd6a069513cf",
              "versionType": "git"
            },
            {
              "lessThan": "f154e41e1d9d15ab21300ba7bbf0ebb5cb3b9c2a",
              "status": "affected",
              "version": "f18c2b77b2e4eec2313d519ba125bd6a069513cf",
              "versionType": "git"
            },
            {
              "lessThan": "50dad9909715094e7d9ca25e9e0412b875987519",
              "status": "affected",
              "version": "f18c2b77b2e4eec2313d519ba125bd6a069513cf",
              "versionType": "git"
            },
            {
              "lessThan": "3cdf199d4755d477972ee87110b2aebc88b3cfad",
              "status": "affected",
              "version": "f18c2b77b2e4eec2313d519ba125bd6a069513cf",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/broadcom/bnxt/bnxt_xdp.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.3"
            },
            {
              "lessThan": "5.3",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.296",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.240",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.189",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.146",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.99",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.39",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.15.*",
              "status": "unaffected",
              "version": "6.15.7",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.16",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.296",
                  "versionStartIncluding": "5.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.240",
                  "versionStartIncluding": "5.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.189",
                  "versionStartIncluding": "5.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.146",
                  "versionStartIncluding": "5.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.99",
                  "versionStartIncluding": "5.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.39",
                  "versionStartIncluding": "5.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.15.7",
                  "versionStartIncluding": "5.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.16",
                  "versionStartIncluding": "5.3",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbnxt_en: Set DMA unmap len correctly for XDP_REDIRECT\n\nWhen transmitting an XDP_REDIRECT packet, call dma_unmap_len_set()\nwith the proper length instead of 0.  This bug triggers this warning\non a system with IOMMU enabled:\n\nWARNING: CPU: 36 PID: 0 at drivers/iommu/dma-iommu.c:842 __iommu_dma_unmap+0x159/0x170\nRIP: 0010:__iommu_dma_unmap+0x159/0x170\nCode: a8 00 00 00 00 48 c7 45 b0 00 00 00 00 48 c7 45 c8 00 00 00 00 48 c7 45 a0 ff ff ff ff 4c 89 45\nb8 4c 89 45 c0 e9 77 ff ff ff \u003c0f\u003e 0b e9 60 ff ff ff e8 8b bf 6a 00 66 66 2e 0f 1f 84 00 00 00 00\nRSP: 0018:ff22d31181150c88 EFLAGS: 00010206\nRAX: 0000000000002000 RBX: 00000000e13a0000 RCX: 0000000000000000\nRDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000\nRBP: ff22d31181150cf0 R08: ff22d31181150ca8 R09: 0000000000000000\nR10: 0000000000000000 R11: ff22d311d36c9d80 R12: 0000000000001000\nR13: ff13544d10645010 R14: ff22d31181150c90 R15: ff13544d0b2bac00\nFS: 0000000000000000(0000) GS:ff13550908a00000(0000) knlGS:0000000000000000\nCS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 00005be909dacff8 CR3: 0008000173408003 CR4: 0000000000f71ef0\nPKRU: 55555554\nCall Trace:\n\u003cIRQ\u003e\n? show_regs+0x6d/0x80\n? __warn+0x89/0x160\n? __iommu_dma_unmap+0x159/0x170\n? report_bug+0x17e/0x1b0\n? handle_bug+0x46/0x90\n? exc_invalid_op+0x18/0x80\n? asm_exc_invalid_op+0x1b/0x20\n? __iommu_dma_unmap+0x159/0x170\n? __iommu_dma_unmap+0xb3/0x170\niommu_dma_unmap_page+0x4f/0x100\ndma_unmap_page_attrs+0x52/0x220\n? srso_alias_return_thunk+0x5/0xfbef5\n? xdp_return_frame+0x2e/0xd0\nbnxt_tx_int_xdp+0xdf/0x440 [bnxt_en]\n__bnxt_poll_work_done+0x81/0x1e0 [bnxt_en]\nbnxt_poll+0xd3/0x1e0 [bnxt_en]"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The faulty unmap is reached purely by inbound network traffic \u2014 a received packet drives the XDP program to XDP_REDIRECT, `xdp_do_redirect()` \u2192 `bq_xmit_all()` \u2192 `bnxt_xdp_xmit()` \u2192 `__bnxt_xmit_xdp_redirect()`, with the corrupt `dma_unmap_len` consumed in `bnxt_tx_int_xdp()` on the NAPI completion. A remote attacker on the internet sending packets through an XDP-redirect load balancer/router built on a Broadcom NetXtreme NIC triggers it with no local access.\nAC:L - Once the (common datacenter) configuration of a bnxt_en NIC with an attached XDP program and IOMMU enabled is present, *every* redirected frame deterministically records `len = 0` and unmaps incorrectly \u2014 no race, no memory-layout grooming, no timing window is involved. The attacker simply sends traffic, and can send it at line rate to reproduce and to drive IOVA/page-table desynchronization.\nPR:N - The entire path from packet receive through `xdp_do_redirect()` to `bnxt_tx_int_xdp()` runs in softirq/NAPI context on behalf of an anonymous remote peer; there is no credential check, socket, or capability gate anywhere along it. The attacker needs no account or authentication on the target host.\nUI:N - No victim action is required \u2014 the redirect and the subsequent TX completion happen automatically in the driver\u0027s NAPI poll as soon as the attacker\u0027s packets arrive.\nS:U - The mis-sized DMA unmap, the leaked IOMMU translation, and the resulting corruption/disclosure all land in the host kernel\u0027s own memory and its own IOVA domain, within a single security authority. No VM, sandbox, or guest-to-host boundary is crossed, so scope is unchanged.\nC:H - Because `dma_unmap_single(len=0)` leaves the IOMMU translation in place (or removes only part of it) while `xdp_return_frame()` releases the page, and the mis-sized `free_iova_fast()` recycles that IOVA into the wrong size bin, a later `dma_map_single()` on the same IOVA collides with the surviving PTE \u2014 which Intel\u0027s `__domain_mapping()` retains while still returning success \u2014 so the NIC reads the previously freed, now-reallocated page and transmits arbitrary kernel/user memory onto the wire.\nI:H - The same IOVA-to-physical desynchronization means device DMA lands on physical pages the kernel has already freed and handed to other subsystems, with the surviving translation permitting access the kernel believes was revoked; combined with `switch_to_super_page()` promotion tearing down page tables covering neighbouring live mappings, this is a memory-corruption primitive whose content is attacker-supplied packet data.\nA:H - The bug reproducibly fires `WARN_ON(unmapped != size)` in `__iommu_dma_unmap()` from IRQ/NAPI context on every redirected frame \u2014 a per-packet splat that panics outright under `panic_on_warn` \u2014 and the under-sized IOVA frees progressively exhaust the device\u0027s IOVA space until `dma_map_single()` fails and the NIC stops forwarding traffic."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:01:55.025Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/e260f4d49370c85a4701d43c6d16b8c39f8b605f"
        },
        {
          "url": "https://git.kernel.org/stable/c/16ae306602163fcb7ae83f2701b542e43c100cee"
        },
        {
          "url": "https://git.kernel.org/stable/c/8d672a1a6bfc81fef9151925c9c0481f4acf4bec"
        },
        {
          "url": "https://git.kernel.org/stable/c/f9eaf6d036075dc820520e1194692c0619b7297b"
        },
        {
          "url": "https://git.kernel.org/stable/c/5909679a82cd74cf0343d9e3ddf4b6931aa7e613"
        },
        {
          "url": "https://git.kernel.org/stable/c/f154e41e1d9d15ab21300ba7bbf0ebb5cb3b9c2a"
        },
        {
          "url": "https://git.kernel.org/stable/c/50dad9909715094e7d9ca25e9e0412b875987519"
        },
        {
          "url": "https://git.kernel.org/stable/c/3cdf199d4755d477972ee87110b2aebc88b3cfad"
        }
      ],
      "title": "bnxt_en: Set DMA unmap len correctly for XDP_REDIRECT",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-38439",
    "datePublished": "2025-07-25T15:27:18.640Z",
    "dateReserved": "2025-04-16T04:51:24.016Z",
    "dateUpdated": "2026-08-05T12:01:55.025Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.