CVE-2025-21973

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

eth: bnxt: fix kernel panic in the bnxt_get_queue_stats{rx | tx}

When qstats-get operation is executed, callbacks of netdev_stats_ops

are called. The bnxt_get_queue_stats{rx | tx} collect per-queue stats

from sw_stats in the rings.

But {rx | tx | cp}_ring are allocated when the interface is up.

So, these rings are not allocated when the interface is down.

The qstats-get is allowed even if the interface is down. However,

the bnxt_get_queue_stats{rx | tx}() accesses cp_ring and tx_ring

without null check.

So, it needs to avoid accessing rings if the interface is down.

Reproducer:

ip link set $interface down

./cli.py --spec netdev.yaml --dump qstats-get

OR

ip link set $interface down

python ./stats.py

Splat looks like:

BUG: kernel NULL pointer dereference, address: 0000000000000000

#PF: supervisor read access in kernel mode

#PF: error_code(0x0000) - not-present page

PGD 1680fa067 P4D 1680fa067 PUD 16be3b067 P

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References