HIGH
bnxt_en TraceBuffer OOB
CVE-2026-31395
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
KernelScan AI7.8HIGH
01Description
In the Linux kernel, the following vulnerability has been resolved: bnxt_en: fix OOB access in DBG_BUF_PRODUCER async event handler The ASYNC_EVENT_CMPL_EVENT_ID_DBG_BUF_PRODUCER handler in bnxt_async_event_process() uses a firmware-supplied 'type' field directly as an index into bp->bs_trace[] without bounds validation. The 'type' field is a 16-bit value extracted from DMA-mapped completion ring memory that the NIC writes directly to host RAM. A malicious or compromised NIC can supply any value from 0 to 65535, causing an out-of-bounds access into kernel heap memory. The bnxt_bs_trace_check_wrap() call then dereferences bs_trace->magic_byte and writes to bs_trace->last_offset and bs_trace->wrapped, leading to kernel memory corruption or a crash. Fix by adding a bounds check and defining BNXT_TRACE_MAX as DBG_LOG_BUFFER_FLUSH_REQ_TYPE_ERR_QPC_TRACE + 1 to cover all currently defined firmware trace types (0x0 through 0xc).
02KernelScan AI Analysis
Risk summary
A malicious or compromised Broadcom NetXtreme NIC can corrupt kernel memory by supplying out-of-bounds array indices in DMA completion rings. This affects systems with bnxt_en network cards and can lead to privilege escalation or system crashes. The vulnerability requires local access but only low privileges to trigger through network interface operations.
Vulnerability analysis
The root cause is missing bounds validation in the DBG_BUF_PRODUCER async event handler, where a firmware-supplied 16-bit 'type' field is used directly as an index into the bp->bs_trace[] array without checking if it exceeds ARRAY_SIZE(bp->bs_trace). Since the NIC writes completion ring data directly to host DMA memory, a compromised NIC firmware can supply any value 0-65535, causing out-of-bounds access into kernel heap memory. The fix adds a bounds check before array access and properly defines BNXT_TRACE_MAX to cover valid trace types 0x0-0xc. Attack surface is local-only since it requires a bnxt_en network interface to be present and the driver loaded, but the malicious data comes from hardware rather than requiring specific user privileges.
03Fix Versions
| Branch | Fixed in | Patch commit |
|---|---|---|
| 6.18 | 6.18.20 | 19aa416eed9e |
| 6.19 | 6.19.10 | b7c7a275447c |
| mainline | 7.0 | 64dcbde7f8f8 |