Answer in brief
CVE-2025-39810 records a Unknown severity vulnerability in bnxt_en: Fix memory corruption when FW resources change during ifdown. The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=ec5d31e3c15d5233b491400133c67f78a320062c <d00e98977ef519280b075d783653e2c492fffbb6 || >=ec5d31e3c15d5233b491400133c67f78a320062c <9ab6a9950f152e094395d2e3967f889857daa185 || >=ec5d31e3c15d5233b491400133c67f78a320062c <2747328ba2714f1a7454208dbbc1dc0631990b4a | d00e98977ef519280b075d783653e2c492fffbb6, 9ab6a9950f152e094395d2e3967f889857daa185, 2747328ba2714f1a7454208dbbc1dc0631990b4a |
| Linux/Linuxgeneric | 5.4 | Not reported |
Published upstream
Sep 16, 2025
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Aug 5, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Aug 5, 2026
In the Linux kernel, the following vulnerability has been resolved: bnxt_en: Fix memory corruption when FW resources change during ifdown bnxt_set_dflt_rings() assumes that it is always called before any TC has been created. So it doesn't take bp->num_tc into account and assumes that it is always 0 or 1. In the FW resource or capability change scenario, the FW will return flags in bnxt_hwrm_if_change() that will cause the driver to reinitialize and call bnxt_cancel_reservations(). This will lead to bnxt_init_dflt_ring_mode() calling bnxt_set_dflt_rings() and bp->num_tc may be greater than 1. This will cause bp->tx_ring[] to be sized too small and cause memory corruption in bnxt_alloc_cp_rings(). Fix it by properly scaling the TX rings by bp->num_tc in the code paths mentioned above. Add 2 helper functions to determine bp->tx_nr_rings and bp->tx_nr_rings_per_tc.
Quoted source text, attributed separately from HOL analysis.
Answer in brief
CVE-2025-39810 records a Unknown severity vulnerability in bnxt_en: Fix memory corruption when FW resources change during ifdown. The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=ec5d31e3c15d5233b491400133c67f78a320062c <d00e98977ef519280b075d783653e2c492fffbb6 || >=ec5d31e3c15d5233b491400133c67f78a320062c <9ab6a9950f152e094395d2e3967f889857daa185 || >=ec5d31e3c15d5233b491400133c67f78a320062c <2747328ba2714f1a7454208dbbc1dc0631990b4a | d00e98977ef519280b075d783653e2c492fffbb6, 9ab6a9950f152e094395d2e3967f889857daa185, 2747328ba2714f1a7454208dbbc1dc0631990b4a |
| Linux/Linuxgeneric | 5.4 | Not reported |
Published upstream
Sep 16, 2025
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Aug 5, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Aug 5, 2026
In the Linux kernel, the following vulnerability has been resolved: bnxt_en: Fix memory corruption when FW resources change during ifdown bnxt_set_dflt_rings() assumes that it is always called before any TC has been created. So it doesn't take bp->num_tc into account and assumes that it is always 0 or 1. In the FW resource or capability change scenario, the FW will return flags in bnxt_hwrm_if_change() that will cause the driver to reinitialize and call bnxt_cancel_reservations(). This will lead to bnxt_init_dflt_ring_mode() calling bnxt_set_dflt_rings() and bp->num_tc may be greater than 1. This will cause bp->tx_ring[] to be sized too small and cause memory corruption in bnxt_alloc_cp_rings(). Fix it by properly scaling the TX rings by bp->num_tc in the code paths mentioned above. Add 2 helper functions to determine bp->tx_nr_rings and bp->tx_nr_rings_per_tc.
Quoted source text, attributed separately from HOL analysis.