CVE-2025-21974

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

eth: bnxt: return fail if interface is down in bnxt_queue_mem_alloc()

The bnxt_queue_mem_alloc() is called to allocate new queue memory when

a queue is restarted.

It internally accesses rx buffer descriptor corresponding to the index.

The rx buffer descriptor is allocated and set when the interface is up

and it's freed when the interface is down.

So, if queue is restarted if interface is down, kernel panic occurs.

Splat looks like:

BUG: unable to handle page fault for address: 000000000000b240

#PF: supervisor read access in kernel mode

#PF: error_code(0x0000) - not-present page

PGD 0 P4D 0

Oops: Oops: 0000 [#1] PREEMPT SMP NOPTI

CPU: 3 UID: 0 PID: 1563 Comm: ncdevmem2 Not tainted 6.14.0-rc2+ #9 844ddba6e7c459cafd0bf4db9a3198e

Hardware name: ASUS System Product Name/PRIME Z690-P D4, BIOS 0603 11/01/2021

RIP: 0010:bnxt_queue_mem_alloc+0x3f/0x4e0 [bnxt_en]

Code: 41 54 4d 89 c4 4d 69 c0 c0 05 00 00 55 48 89 f5

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References