Linux bnxt_en driver (XDP redirect list flush): List corruption in the XDP redirect path, found crashing production

Impact

List corruption in the XDP redirect path, found crashing production systems. Same family as the other bnxt XDP defects: if you run XDP for packet steering in front of inference endpoints, the Broadcom driver's redirect path has repeatedly been the weak spot, and the failure mode is a host crash rather than a graceful drop.

Who can reach it

Traffic through an attached XDP program using redirect on a Broadcom NIC.

What to do

Kernel/driver upgrade plus host reboot. Companion fix CVE-2025-38439 (wrong DMA unmap length on XDP_REDIRECT) is in the same area — take both. Interim: detach XDP from Broadcom interfaces.

References