Linux Kernel prior 6.15-rc5 bnxt_en memcpy memory corruption

CVSS Meta Temp Score
CVSS is a standardized scoring system to determine possibilities of attacks. The Temp Score considers temporal factors like disclosure, exploit and countermeasures. The unique Meta Score calculates the average score of different sources to provide a normalized scoring system.
Current Exploit Price (≈)
Our analysts are monitoring exploit markets and are in contact with vulnerability brokers. The range indicates the observed or calculated exploit price to be seen on exploit markets. A good indicator to understand the monetary effort required for and the popularity of an attack.
CTI Interest Score
Our Cyber Threat Intelligence team is monitoring different web sites, mailing lists, exploit markets and social media networks. The CTI Interest Score identifies the interest of attackers and the security community for this specific vulnerability in real-time. A high score indicates an elevated risk to be targeted for this vulnerability.
6.6$0-$5k0.00

Summaryinfo

A vulnerability was found in Linux Kernel. It has been rated as critical. Affected is the function memcpy of the component bnxt_en. This manipulation causes memory corruption. This vulnerability is registered as CVE-2025-37911. No exploit is available. Upgrading the affected component is advised.

Detailsinfo

A vulnerability was found in Linux Kernel. It has been declared as critical. Affected by this vulnerability is the function memcpy of the component bnxt_en. The manipulation with an unknown input leads to a memory corruption vulnerability. The CWE definition for the vulnerability is CWE-119. The product performs operations on a memory buffer, but it can read from or write to a memory location that is outside of the intended boundary of the buffer. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

In the Linux kernel, the following vulnerability has been resolved: bnxt_en: Fix out-of-bound memcpy() during ethtool -w When retrieving the FW coredump using ethtool, it can sometimes cause memory corruption: BUG: KFENCE: memory corruption in __bnxt_get_coredump+0x3ef/0x670 [bnxt_en] Corrupted memory at 0x000000008f0f30e8 [ ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ] (in kfence-#45): __bnxt_get_coredump+0x3ef/0x670 [bnxt_en] ethtool_get_dump_data+0xdc/0x1a0 __dev_ethtool+0xa1e/0x1af0 dev_ethtool+0xa8/0x170 dev_ioctl+0x1b5/0x580 sock_do_ioctl+0xab/0xf0 sock_ioctl+0x1ce/0x2e0 __x64_sys_ioctl+0x87/0xc0 do_syscall_64+0x5c/0xf0 entry_SYSCALL_64_after_hwframe+0x78/0x80 ... This happens when copying the coredump segment list in bnxt_hwrm_dbg_dma_data() with the HWRM_DBG_COREDUMP_LIST FW command. The info->dest_buf buffer is allocated based on the number of coredump segments returned by the FW. The segment list is then DMA'ed by the FW and the length of the DMA is returned by FW. The driver then copies this DMA'ed segment list to info->dest_buf. In some cases, this DMA length may exceed the info->dest_buf length and cause the above BUG condition. Fix it by capping the copy length to not exceed the length of info->dest_buf. The extra DMA data contains no useful information. This code path is shared for the HWRM_DBG_COREDUMP_LIST and the HWRM_DBG_COREDUMP_RETRIEVE FW commands. The buffering is different for these 2 FW commands. To simplify the logic, we need to move the line to adjust the buffer length for HWRM_DBG_COREDUMP_RETRIEVE up, so that the new check to cap the copy length will work for both commands.

It is possible to read the advisory at git.kernel.org. This vulnerability is known as CVE-2025-37911 since 04/16/2025. The exploitation appears to be easy. Technical details of the vulnerability are known, but there is no available exploit. The pricing for an exploit might be around USD $0-$5k at the moment (estimation calculated on 12/14/2025).

The vulnerability scanner Nessus provides a plugin with the ID 237223 (Debian dsa-5925 : affs-modules-6.1.0-33-4kc-malta-di - security update), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 5.15.182, 6.1.138, 6.6.90, 6.12.28, 6.14.6 or 6.15-rc5 eliminates this vulnerability. Applying the patch 69b10dd23ab826d0c7f2d9ab311842251978d0c1/43292b83424158fa6ec458799f3cb9c54d18c484/4d69864915a3a052538e4ba76cd6fd77cfc64ebe/44807af79efd0d78fa36383dd865ddfe7992c0a6/44d81a9ebf0cad92512e0ffdf7412bfe20db66ec/6b87bd94f34370bbf1dfa59352bed8efab5bf419 is able to eliminate this problem. The bugfix is ready for download at git.kernel.org. The best possible mitigation is suggested to be upgrading to the latest version.

The vulnerability is also documented in the databases at Tenable (237223) and CERT Bund (WID-SEC-2025-1114). Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Affected

  • Debian Linux
  • Amazon Linux 2
  • Red Hat Enterprise Linux
  • Ubuntu Linux
  • SUSE Linux
  • Oracle Linux
  • SUSE openSUSE
  • Dell Avamar
  • Open Source Linux Kernel
  • Dell NetWorker
  • Dell Secure Connect Gateway

Productinfo

Type

Vendor

Name

License

Website

CPE 2.3info

CPE 2.2info

CVSSv4info

VulDB Vector: 🔍
VulDB Reliability: 🔍

CVSSv3info

VulDB Meta Base Score: 6.8
VulDB Meta Temp Score: 6.6

VulDB Base Score: 8.0
VulDB Temp Score: 7.6
VulDB Vector: 🔍
VulDB Reliability: 🔍

NVD Base Score: 5.5
NVD Vector: 🔍

CVSSv2info

AVACAuCIA
💳💳💳💳💳💳
💳💳💳💳💳💳
💳💳💳💳💳💳
VectorComplexityAuthenticationConfidentialityIntegrityAvailability
UnlockUnlockUnlockUnlockUnlockUnlock
UnlockUnlockUnlockUnlockUnlockUnlock
UnlockUnlockUnlockUnlockUnlockUnlock

VulDB Base Score: 🔍
VulDB Temp Score: 🔍
VulDB Reliability: 🔍

Exploitinginfo

Class: Memory corruption
CWE: CWE-119
CAPEC: 🔍
ATT&CK: 🔍

Physical: Partially
Local: Yes
Remote: Partially

Availability: 🔍
Status: Not defined

EPSS Score: 🔍
EPSS Percentile: 🔍

Price Prediction: 🔍
Current Price Estimation: 🔍

0-DayUnlockUnlockUnlockUnlock
TodayUnlockUnlockUnlockUnlock

Nessus ID: 237223
Nessus Name: Debian dsa-5925 : affs-modules-6.1.0-33-4kc-malta-di - security update

Threat Intelligenceinfo

Interest: 🔍
Active Actors: 🔍
Active APT Groups: 🔍

Countermeasuresinfo

Recommended: Upgrade
Status: 🔍

0-Day Time: 🔍

Upgrade: Kernel 5.15.182/6.1.138/6.6.90/6.12.28/6.14.6/6.15-rc5
Patch: 69b10dd23ab826d0c7f2d9ab311842251978d0c1/43292b83424158fa6ec458799f3cb9c54d18c484/4d69864915a3a052538e4ba76cd6fd77cfc64ebe/44807af79efd0d78fa36383dd865ddfe7992c0a6/44d81a9ebf0cad92512e0ffdf7412bfe20db66ec/6b87bd94f34370bbf1dfa59352bed8efab5bf419

Timelineinfo

04/16/2025 🔍
05/20/2025 +34 days 🔍
05/20/2025 +0 days 🔍
12/14/2025 +208 days 🔍

Sourcesinfo

Vendor: kernel.org

Advisory: git.kernel.org
Status: Confirmed

CVE: CVE-2025-37911 (🔍)
GCVE (CVE): GCVE-0-2025-37911
GCVE (VulDB): GCVE-100-309715
CERT Bund: WID-SEC-2025-1114 - Linux Kernel: Mehrere Schwachstellen

Entryinfo

Created: 05/20/2025 18:01
Updated: 12/14/2025 13:07
Changes: 05/20/2025 18:01 (58), 05/25/2025 03:14 (2), 08/10/2025 15:43 (7), 09/28/2025 01:51 (1), 11/17/2025 18:02 (12), 12/14/2025 13:07 (1)
Complete: 🔍
Cache ID: 216::103

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion

No comments yet. Languages: en.

Please log in to comment.

◂ PreviousOverviewNext ▸

Interested in the pricing of exploits?

See the underground prices here!