Linux bnxt_en driver (ring defaults vs traffic classes on ifdown): Memory corruption when firmware resources change

Impact

Memory corruption when firmware resources change while the interface is down, because the default-ring calculation assumes no traffic classes have been created. Relevant to RoCE clusters specifically: traffic classes are how you carve out lossless queues for RDMA with PFC, so any cluster running RoCEv2 with DCB has traffic classes configured and is in the affected configuration by construction.

Who can reach it

Local — an interface down/up cycle combined with a firmware resource change, on a host with traffic classes configured.

What to do

Kernel/driver upgrade plus host reboot. Until then, avoid ifdown/ifup cycles on RoCE-configured Broadcom interfaces as a routine operational step — use link-level draining at the switch instead.

References

Related entries

• Linux kernel (drivers/infiniband/sw/rxe): Use-after-free from a race between a busy soft-RoCE task and its ownCVE-2025-40061 · Linux kernel (drivers/infiniband/sw/rxe)High
• The Linux kernel's IPMI driver message-handling layer: A use-after-free in a kernel driver reachable from the host'sCVE-2025-40202 · The Linux kernel's IPMI driver message-handling layerHigh
• Eaton UPS Companion (EUC) executable - library loading: Insecure library loading in the shipped executable givesCVE-2025-67450 · Eaton UPS Companion (EUC) executable - library loadingHigh
• Linux kernel (drivers/infiniband/sw/rxe): Two failed shared-receive-queue resizes in a row panic the node. The firstCVE-2025-68379 · Linux kernel (drivers/infiniband/sw/rxe)High
• Linux kernel mlxsw (Spectrum switch router, neighbour table): The driver stored neighbour pointers without holdingCVE-2025-68801 · Linux kernel mlxsw (Spectrum switch router, neighbour table)High
• Linux bnxt_re RoCE driver (bnxt_re_copy_err_stats out-of-bounds write): Out-of-bounds write in the Broadcom RoCECVE-2025-71092 · Linux bnxt_re RoCE driver (bnxt_re_copy_err_stats out-of-bounds write)High