Linux Kernel up to 6.18.3/6.19-rc3 bnxt_re bnxt_re_copy_err_stats num_counters out-of-bounds write

Summaryinfo

A vulnerability identified as critical has been detected in Linux Kernel up to 6.18.3/6.19-rc3. This vulnerability affects the function bnxt_re_copy_err_stats of the component bnxt_re. Performing a manipulation of the argument num_counters results in out-of-bounds write. This vulnerability is cataloged as CVE-2025-71092. There is no exploit available. You should upgrade the affected component.

Detailsinfo

A vulnerability was found in Linux Kernel up to 6.18.3/6.19-rc3. It has been classified as critical. This affects the function bnxt_re_copy_err_stats of the component bnxt_re. The manipulation of the argument num_counters with an unknown input leads to a out-of-bounds write vulnerability. CWE is classifying the issue as CWE-787. The product writes data past the end, or before the beginning, of the intended buffer. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

In the Linux kernel, the following vulnerability has been resolved: RDMA/bnxt_re: Fix OOB write in bnxt_re_copy_err_stats() Commit ef56081d1864 ("RDMA/bnxt_re: RoCE related hardware counters update") added three new counters and placed them after BNXT_RE_OUT_OF_SEQ_ERR. BNXT_RE_OUT_OF_SEQ_ERR acts as a boundary marker for allocating hardware statistics with different num_counters values on chip_gen_p5_p7 devices. As a result, BNXT_RE_NUM_STD_COUNTERS are used when allocating hw_stats, which leads to an out-of-bounds write in bnxt_re_copy_err_stats(). The counters BNXT_RE_REQ_CQE_ERROR, BNXT_RE_RESP_CQE_ERROR, and BNXT_RE_RESP_REMOTE_ACCESS_ERRS are applicable to generic hardware, not only p5/p7 devices. Fix this by moving these counters before BNXT_RE_OUT_OF_SEQ_ERR so they are included in the generic counter set.

The advisory is shared at git.kernel.org. This vulnerability is uniquely identified as CVE-2025-71092 since 01/13/2026. The exploitability is told to be easy. Technical details are known, but no exploit is available. The price for an exploit might be around USD $5k-$25k at the moment (estimation calculated on 03/31/2026).

Upgrading to version 6.18.4 or 6.19-rc4 eliminates this vulnerability. Applying the patch 369a161c48723f60f06f3510b82ea7d96d0499ab/9b68a1cc966bc947d00e4c0df7722d118125aa37 is able to eliminate this problem. The bugfix is ready for download at git.kernel.org. The best possible mitigation is suggested to be upgrading to the latest version.

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Type

• Operating System

Vendor

• Linux

Name

• Kernel

Version

• 6.18.0
• 6.18.1
• 6.18.2
• 6.18.3
• 6.19-rc1
• 6.19-rc2
• 6.19-rc3

License

• open-source

Website

• Vendor: https://www.kernel.org/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion