Linux bnxt_en driver (bnxt_fill_hw_rss_tbl): Memory out-of-bounds in the RSS indirection-table path of the Broadcom NIC

Impact

Memory out-of-bounds in the RSS indirection-table path of the Broadcom NIC driver, giving kernel panic, denial of service, or an information leak out of kernel memory. The information-leak arm is the one that matters for multi-tenancy — kernel memory on a shared host contains other workloads' data.

Who can reach it

Reachable through ring-reservation and RSS configuration paths in the driver; local host privilege or specific traffic conditions depending on the trigger.

What to do

Kernel/driver upgrade and host reboot. Rolling across the fleet during normal maintenance; no firmware flash needed.

References

Related entries

• Linux kernel mpi3mr driver (Broadcom tri-mode 9600-series HBA/RAID) and megaraid_sas driver: Rapidly toggling PHYCVE-2024-57804 · Linux kernel mpi3mr driver (Broadcom tri-mode 9600-series HBA/RAID) and megaraid_sas driverHigh
• BullSequana XH3406/XH3515 BMC: factory reset can leave root enabled with no passwordCVE-2025-15679 · BullSequana XH3406 / XH3515 BMC (root account after factory reset)High
• AMI AptioV UEFI BIOS: A race condition in the BIOS that a skilled local attacker can drive to resource exhaustionCVE-2025-22830 · AMI AptioV UEFI BIOSHigh
• AMI AptioV BIOS (unchecked buffer copy): Buffer copy without size checking in firmware leading to arbitrary codeCVE-2025-22833 · AMI AptioV BIOS (unchecked buffer copy)High
• AMD Secure Processor (ASP) bootloader - buffer overflow: A buffer overflow in the ASP bootloader gives an attacker aCVE-2025-29951 · AMD Secure Processor (ASP) bootloader - buffer overflowHigh
• Linux x86/sev - Secure TSC frequency calculation (TSC_FACTOR): Secure TSC is how an SEV-SNP guest gets a timebaseCVE-2025-38508 · Linux x86/sev - Secure TSC frequency calculation (TSC_FACTOR)High