CVE-2025-68770 Linux CVE debrief

Who should care

System administrators and security teams managing Linux kernel-based systems, especially those utilizing the bnxt_en driver, should be aware of this vulnerability and apply the necessary patches to prevent potential denial-of-service attacks.

Technical summary

The CVE-2025-68770 vulnerability is related to the bnxt_en driver in the Linux kernel. The issue occurs in the XDP_TX path within the bnxt_rx_xdp() function, where incorrect clearing of event flags can lead to TX producer inconsistencies and packet drops. The fix ensures that BNXT_RX_EVENT is only cleared after a successful __bnxt_xmit_xdp() call. For XDP_TX action in bnxt_rx_xdp(), clearing of the event flags is not correct. __bnxt_poll_work() -> bnxt_rx_pkt() -> bnxt_rx_xdp() may be looping within NAPI and some event flags may be set in earlier iterations. In particular, if BNXT_TX_EVENT is set earlier indicating some XDP_TX packets are ready and pending, it will be cleared if it is XDP_TX action again. Normally, we will set BNXT_TX_EVENT again when we successfully call __bnxt_xmit_xdp(). But if the TX ring has no more room, the flag will not be set. This will cause the TX producer to be ahead but the driver will not hit the TX doorbell. For multi-buf XDP_TX, there is no need to clear the event flags and set BNXT_AGG_EVENT. The BNXT_AGG_EVENT flag should have been set earlier in bnxt_rx_pkt(). The visible symptom of this is that the RX ring associated with the TX XDP ring will eventually become empty and all packets will be dropped. Because this condition will cause the driver to not refill the RX ring seeing that the TX ring has forever pending XDP_TX packets.

Defensive priority

This HIGH severity vulnerability in the Linux kernel's bnxt_en driver could allow an attacker to cause a denial of service. Users should review and apply the fix to prevent potential disruptions.

Recommended defensive actions

• Review and apply the provided kernel patches to ensure the bnxt_en driver is updated with the fix.
• Monitor Linux kernel updates for any related security advisories.
• Perform vulnerability scanning to identify affected systems.
• Implement compensating controls to detect and prevent potential exploitation attempts.
• Verify system configurations to ensure they align with security best practices.

Evidence notes

The CVE-2025-68770 vulnerability involves an issue in the bnxt_en driver of the Linux kernel, specifically affecting the XDP_TX path in the bnxt_rx_xdp() function. The problem arises from incorrect clearing of event flags, which can lead to the TX producer being ahead without triggering the TX doorbell, causing packets to be dropped. A fix has been applied to only clear BNXT_RX_EVENT when __bnxt_xmit_xdp() is successfully called.

Official resources