Database/Firmware, BMC & network fabric
Linux bnxt_en driver (5760X / P7 aggregation ID mask): The bnxt_en driver mishandles the aggregation ID mask on 5760X
Impact
The bnxt_en driver mishandles the aggregation ID mask on 5760X (P7) chips, oopsing the kernel. P7 is the Thor2 generation — the 400G-class Broadcom NIC going into current AI server designs — so this specifically hits new GPU-node builds rather than legacy hardware. A kernel oops on a training node kills the job for every rank in the collective, not just that node.
Who can reach it
Triggered by received traffic patterns hitting the hardware GRO/LRO path. Effectively remote from anything that can send traffic to the node.
What to do
Kernel or driver package upgrade plus a host reboot. Standard rolling-reboot across the fleet, but coordinate with running jobs — a mid-training reboot is more expensive than the patch. If you build your own kernels, this is a backport-and-rebuild.
References
Related entries
- Linux kernel (drivers/infiniband/hw/bnxt_re): The driver advertises support for 13 scatter-gather entries per workCVE-2024-57936 · Linux kernel (drivers/infiniband/hw/bnxt_re)Critical
- Linux kernel (drivers/infiniband/ulp/rtrs): A remote client corrupts kernel linked lists on the RDMA block-storageCVE-2025-21805 · Linux kernel (drivers/infiniband/ulp/rtrs)Critical
- Linux kernel (drivers/infiniband/hw/erdma): Use-after-free while accepting an inbound RDMA connection. The connectionCVE-2025-22088 · Linux kernel (drivers/infiniband/hw/erdma)Critical
- Linux kernel (drivers/infiniband/core): The iWARP connection manager frees the work objects it is currently executingCVE-2025-38211 · Linux kernel (drivers/infiniband/core)Critical
- Linux bnxt_en driver (XDP redirect list flush): List corruption in the XDP redirect path, found crashing productionCVE-2025-38246 · Linux bnxt_en driver (XDP redirect list flush)Critical
- Linux kernel NVMe-oF TCP host (nvme-tcp R2T PDU request-list handling): Nvme_tcp_handle_r2t() did not check that theCVE-2025-38264 · Linux kernel NVMe-oF TCP host (nvme-tcp R2T PDU request-list handling)Critical
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.