Database/Firmware, BMC & network fabric
Linux bnxt_en driver (DBG_BUF_PRODUCER async event handler): The async-event handler indexes a fixed array
Impact
The async-event handler indexes a fixed array with a type field supplied by the NIC firmware, without bounds checking — so firmware controls a kernel array index. This is the concrete version of a threat operators often wave at abstractly: if the adapter's firmware is compromised or buggy, it has a direct path into kernel memory corruption on the host. Every argument for verifying NIC firmware provenance at intake rests on bugs of exactly this shape.
Who can reach it
The NIC firmware itself, or anything that can influence what the firmware reports — which includes a firmware image installed at build time or by a previous tenant on bare metal.
What to do
Kernel/driver upgrade plus host reboot. The durable control is separate: verify and reflash NIC firmware from a known-good image at rack intake and at tenant handoff, so the host is not trusting whatever firmware happens to be on the card.
References
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.