---
id: CVE-2025-39810
title: 'bnxt_en: Fix memory corruption when FW resources change during ifdown'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  bnxt_en: Fix memory corruption when FW resources change during ifdown

  bnxt_set_dflt_rings() assumes that it is always called before any TC has
  been created.  So it doe…
severity: high
cvss: 7.8
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
cvssSource: cna
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= ec5d31e3c15d5233b491400133c67f78a320062c <
    c0082a8947cf1a543013346d10c1857f0c57db83
  - >-
    Linux >= ec5d31e3c15d5233b491400133c67f78a320062c <
    dc797a4bbbcac6d19e6e2508e4df685755cd94a5
  - >-
    Linux >= ec5d31e3c15d5233b491400133c67f78a320062c <
    d00e98977ef519280b075d783653e2c492fffbb6
  - >-
    Linux >= ec5d31e3c15d5233b491400133c67f78a320062c <
    9ab6a9950f152e094395d2e3967f889857daa185
  - >-
    Linux >= ec5d31e3c15d5233b491400133c67f78a320062c <
    2747328ba2714f1a7454208dbbc1dc0631990b4a
  - Linux 5.4
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-01-14T18:14:51.954727Z'
published: '2025-09-16'
updated: '2026-10-30'
sourceUpdated: '2026-10-30T12:22:29.953Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2025-39810'
references:
  - url: 'https://git.kernel.org/stable/c/c0082a8947cf1a543013346d10c1857f0c57db83'
  - url: 'https://git.kernel.org/stable/c/dc797a4bbbcac6d19e6e2508e4df685755cd94a5'
  - url: 'https://git.kernel.org/stable/c/d00e98977ef519280b075d783653e2c492fffbb6'
  - url: 'https://git.kernel.org/stable/c/9ab6a9950f152e094395d2e3967f889857daa185'
  - url: 'https://git.kernel.org/stable/c/2747328ba2714f1a7454208dbbc1dc0631990b4a'
tags:
  - cve.org
epss: 0.00199
epssPercentile: 0.09737
ingestedAt: '2026-10-21T12:48:53.698Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

bnxt_en: Fix memory corruption when FW resources change during ifdown

bnxt_set_dflt_rings() assumes that it is always called before any TC has
been created.  So it doesn't take bp->num_tc into account and assumes
that it is always 0 or 1.

In the FW resource or capability change scenario, the FW will return
flags in bnxt_hwrm_if_change() that will cause the driver to
reinitialize and call bnxt_cancel_reservations().  This will lead to
bnxt_init_dflt_ring_mode() calling bnxt_set_dflt_rings() and bp->num_tc
may be greater than 1.  This will cause bp->tx_ring[] to be sized too
small and cause memory corruption in bnxt_alloc_cp_rings().

Fix it by properly scaling the TX rings by bp->num_tc in the code
paths mentioned above.  Add 2 helper functions to determine
bp->tx_nr_rings and bp->tx_nr_rings_per_tc.

## Affected

- `Linux >= ec5d31e3c15d5233b491400133c67f78a320062c < c0082a8947cf1a543013346d10c1857f0c57db83`
- `Linux >= ec5d31e3c15d5233b491400133c67f78a320062c < dc797a4bbbcac6d19e6e2508e4df685755cd94a5`
- `Linux >= ec5d31e3c15d5233b491400133c67f78a320062c < d00e98977ef519280b075d783653e2c492fffbb6`
- `Linux >= ec5d31e3c15d5233b491400133c67f78a320062c < 9ab6a9950f152e094395d2e3967f889857daa185`
- `Linux >= ec5d31e3c15d5233b491400133c67f78a320062c < 2747328ba2714f1a7454208dbbc1dc0631990b4a`
- `Linux 5.4`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.