CVE-2025-21960

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

eth: bnxt: do not update checksum in bnxt_xdp_build_skb()

The bnxt_rx_pkt() updates ip_summed value at the end if checksum offload

is enabled.

When the XDP-MB program is attached and it returns XDP_PASS, the

bnxt_xdp_build_skb() is called to update skb_shared_info.

The main purpose of bnxt_xdp_build_skb() is to update skb_shared_info,

but it updates ip_summed value too if checksum offload is enabled.

This is actually duplicate work.

When the bnxt_rx_pkt() updates ip_summed value, it checks if ip_summed

is CHECKSUM_NONE or not.

It means that ip_summed should be CHECKSUM_NONE at this moment.

But ip_summed may already be updated to CHECKSUM_UNNECESSARY in the

XDP-MB-PASS path.

So the by skb_checksum_none_assert() WARNS about it.

This is duplicate work and updating ip_summed in the

bnxt_xdp_build_skb() is not needed.

Splat looks like:

WARNING: CPU: 3 PID: 5782 at ./include/linux/skbuff.h:5155 bnxt_rx_pkt+0x479b/0x7610

Remediation

Check the references section for vendor advisories and patches from linux. Update linux_kernel to the latest patched version. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

Affected Products

References