Linux bnxt_en driver (ethtool coredump / bnxt_get_coredump): Out-of-bounds memcpy when retrieving a firmware coredump

Impact

Out-of-bounds memcpy when retrieving a firmware coredump via ethtool — the returned DMA length can exceed the buffer the driver allocated, corrupting kernel memory. What makes this operationally awkward is that ethtool -w is exactly what your support workflow runs when a NIC misbehaves, so the diagnostic step is the trigger.

Who can reach it

Local privileged user running an ethtool coredump against the NIC, with firmware returning an over-long length. Relevant if tenants have root on bare metal, or if a compromised NIC firmware can influence the returned length.

What to do

Kernel/driver upgrade plus host reboot. Until patched, avoid ethtool -w on Broadcom NICs in your automated diagnostics.

References

Related entries

• Linux kernel Soft-RoCE completion queue (rdma_rxe, rxe_cq_cleanup on create failure): Syzkaller-found slabCVE-2025-38024 · Linux kernel Soft-RoCE completion queue (rdma_rxe, rxe_cq_cleanup on create failure)High
• Linux KVM/SVM - SEV/SEV-ES intra-host migration during vCPU creation: KVM permitted SEV/SEV-ES intra-host migrationCVE-2025-38455 · Linux KVM/SVM - SEV/SEV-ES intra-host migration during vCPU creationHigh
• Dell iDRAC Service Module (iSM): Buffer access with incorrect length in the in-band agent gives a low-privileged localCVE-2025-38743 · Dell iDRAC Service Module (iSM)High
• Linux bnxt_en driver (ring defaults vs traffic classes on ifdown): Memory corruption when firmware resources changeCVE-2025-39810 · Linux bnxt_en driver (ring defaults vs traffic classes on ifdown)High
• Linux kernel (drivers/infiniband/sw/rxe): Use-after-free from a race between a busy soft-RoCE task and its ownCVE-2025-40061 · Linux kernel (drivers/infiniband/sw/rxe)High
• The Linux kernel's IPMI driver message-handling layer: A use-after-free in a kernel driver reachable from the host'sCVE-2025-40202 · The Linux kernel's IPMI driver message-handling layerHigh