CVE-2025-22108

In the Linux kernel, the following vulnerability has been resolved:

bnxt_en: Mask the bd_cnt field in the TX BD properly

The bd_cnt field in the TX BD specifies the total number of BDs for the TX packet. The bd_cnt field has 5 bits and the maximum number supported is 32 with the value 0.

CONFIG_MAX_SKB_FRAGS can be modified and the total number of SKB fragments can approach or exceed the maximum supported by the chip. Add a macro to properly mask the bd_cnt field so that the value 32 will be properly masked and set to 0 in the bd_cnd field.

Without this patch, the out-of-range bd_cnt value will corrupt the TX BD and may cause TX timeout.

The next patch will check for values exceeding 32.

Only local user can trigger this bug. Need to modify the value of CONFIG_MAX_SKB_FRAGS to trigger it. For the Red Hat Enterprise Linux with the default value of the CONFIG_MAX_SKB_FRAGS would be complex to trigger. The security impact is limited to the deny of service (if would be possible to trigger it).

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, prevent module bnxt_en from being loaded. Please see https://access.redhat.com/solutions/41278 for how to blacklist a kernel module to prevent it from loading automatically.