Linux bnxt_en driver (TX BD bd_cnt field masking): The 5-bit bd_cnt field in the transmit buffer descriptor

CVSS 8.6CVE-2025-22108Firmware, BMC & network fabriccurated

Impact

The 5-bit bd_cnt field in the transmit buffer descriptor is not masked, so an out-of-range value corrupts transmit descriptors and produces TX timeouts. Practically: the NIC stops transmitting. On a training node that is a hung collective, and the failure looks like a network problem rather than a driver bug, so it burns debugging time.

Who can reach it

Triggered by transmit paths that produce a descriptor count above the representable range. Local, driven by workload traffic patterns.

What to do

Kernel/driver upgrade plus host reboot. No firmware change required.

References

https://nvd.nist.gov/vuln/detail/CVE-2025-22108

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.