CVE-2025-37911bnxt_en: Fix out-of-bound memcpy() during ethtool -w
Updated under an hour ago ()
Does this affect you?
It affects Linux and 2 other products. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: bnxt_en: Fix out-of-bound memcpy() during ethtool -w When retrieving the FW coredump using ethtool, it can sometimes cause memory corruption: BUG: KFENCE: memory corruption in __bnxt_get_coredump+0x3ef/0x670 [bnxt_en] Corrupted memory at 0x000000008f0f30e8 [ ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ] (in kfence-#45): __bnxt_get_coredump+0x3ef/0x670 [bnxt_en] ethtool_get_dump_data+0xdc/0x1a0 __dev_ethtool+0xa1e/0x1af0 dev_ethtool+0xa8/0x170 dev_ioctl+0x1b5/0x580 sock_do_ioctl+0xab/0xf0 sock_ioctl+0x1ce/0x2e0 __x64_sys_ioctl+0x87/0xc0 do_syscall_64+0x5c/0xf0 entry_SYSCALL_64_after_hwframe+0x78/0x80 ... This happens when copying the coredump segment list in bnxt_hwrm_dbg_dma_data() with the HWRM_DBG_COREDUMP_LIST FW command. The info->dest_buf buffer is allocated based on the number of coredump segments returned by the FW. The segment list is then DMA'ed by the FW and the length of the DMA is returned by FW. The driver then copies this DMA'ed segment list to info->dest_buf. In some cases, this DMA length may exceed the info->dest_buf length and cause the above BUG condition. Fix it by capping the copy length to not exceed the length of info->dest_buf. The extra DMA data contains no useful information. This code path is shared for the HWRM_DBG_COREDUMP_LIST and the HWRM_DBG_COREDUMP_RETRIEVE FW commands. The buffering is different for these 2 FW commands. To simplify the logic, we need to move the line to adjust the buffer length for HWRM_DBG_COREDUMP_RETRIEVE up, so that the new check to cap the copy length will work for both commands.
- CVSS
- 7.8 HIGH (v3.1, CNA)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Modified
- Record last updated
- Oct 15, 2026
- First seen by InfoSec Signals
- Oct 15, 2026
Affected products
Linux Linux linux:linux (from the name) | from c74751f4c39232c31214ec6a3bc1c7e62f5c728b before 69b10dd23ab826d0c7f2d9ab311842251978d0c1; from c74751f4c39232c31214ec6a3bc1c7e62f5c728b before 43292b83424158fa6ec458799f3cb9c54d18c484; from c74751f4c39232c31214ec6a3bc1c7e62f5c728b before 4d69864915a3a052538e4ba76cd6fd77cfc64ebe; from c74751f4c39232c31214ec6a3bc1c7e62f5c728b before 44807af79efd0d78fa36383dd865ddfe7992c0a6; from c74751f4c39232c31214ec6a3bc1c7e62f5c728b before 44d81a9ebf0cad92512e0ffdf7412bfe20db66ec; from c74751f4c39232c31214ec6a3bc1c7e62f5c728b before 6b87bd94f34370bbf1dfa59352bed8efab5bf419; 4bf973a1f84aefb64750bdb3afe72d54de3199d7; a76837dd731b68cc3b5690470bc9efa2a8e3801a; and 2 more ranges | CNA record |
linux linux_kernel linux:linux_kernel | from 4.19.95 before 4.20; from 5.4.8 before 5.5; from 5.5.1 before 5.15.182; from 5.16 before 6.1.138; from 6.2 before 6.6.90; from 6.7 before 6.12.28; from 6.13 before 6.14.6; 5.5; and 9 more ranges | NVD |
debian debian_linux debian:debian_linux | 11.0 | NVD |
References
- https://git.kernel.org/stable/c/69b10dd23ab826d0c7f2d9ab311842251978d0c1patch
- https://git.kernel.org/stable/c/43292b83424158fa6ec458799f3cb9c54d18c484patch
- https://git.kernel.org/stable/c/4d69864915a3a052538e4ba76cd6fd77cfc64ebepatch
- https://git.kernel.org/stable/c/44807af79efd0d78fa36383dd865ddfe7992c0a6patch
- https://git.kernel.org/stable/c/44d81a9ebf0cad92512e0ffdf7412bfe20db66ecpatch
- https://git.kernel.org/stable/c/6b87bd94f34370bbf1dfa59352bed8efab5bf419patch
- https://lists.debian.org/debian-lts-announce/2025/08/msg00010.htmlmailing-list
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.