CVE-2025-21973— eth: bnxt: fix kernel panic in the bnxt_get_queue_stats{rx | tx}
Possible ATT&CK Techniques 2AI
T1059 · Command and Scripting Interpreter T1083 · File and Directory DiscoveryAffected Version Matrix 8
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Linux | Linux | af7b3b4adda592cb49e202f3617454d5dda4c5b5< f059a0fd733078c3832fd0f3a3037aa5975d3d36 | affected |
af7b3b4adda592cb49e202f3617454d5dda4c5b5< adb830085f0fc3a09a0fc8b64fed2e7c8d244665 | affected | ||
af7b3b4adda592cb49e202f3617454d5dda4c5b5< f09af5fdfbd9b0fcee73aab1116904c53b199e97 | affected | ||
6.9 | affected | ||
< 6.9 | unaffected | ||
6.12.20≤ 6.12.* | unaffected | ||
6.13.8≤ 6.13.* | unaffected | ||
6.14≤ * | unaffected |
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2025-21973
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
eth: bnxt: fix kernel panic in the bnxt_get_queue_stats{rx | tx}
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: eth: bnxt: fix kernel panic in the bnxt_get_queue_stats{rx | tx} When qstats-get operation is executed, callbacks of netdev_stats_ops are called. The bnxt_get_queue_stats{rx | tx} collect per-queue stats from sw_stats in the rings. But {rx | tx | cp}_ring are allocated when the interface is up. So, these rings are not allocated when the interface is down. The qstats-get is allowed even if the interface is down. However, the bnxt_get_queue_stats{rx | tx}() accesses cp_ring and tx_ring without null check. So, it needs to avoid accessing rings if the interface is down. Reproducer: ip link set $interface down ./cli.py --spec netdev.yaml --dump qstats-get OR ip link set $interface down python ./stats.py Splat looks like: BUG: kernel NULL pointer dereference, address: 0000000000000000 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page PGD 1680fa067 P4D 1680fa067 PUD 16be3b067 PMD 0 Oops: Oops: 0000 [#1] PREEMPT SMP NOPTI CPU: 0 UID: 0 PID: 1495 Comm: python3 Not tainted 6.14.0-rc4+ #32 5cd0f999d5a15c574ac72b3e4b907341 Hardware name: ASUS System Product Name/PRIME Z690-P D4, BIOS 0603 11/01/2021 RIP: 0010:bnxt_get_queue_stats_rx+0xf/0x70 [bnxt_en] Code: c6 87 b5 18 00 00 02 eb a2 66 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 1f 44 01 RSP: 0018:ffffabef43cdb7e0 EFLAGS: 00010282 RAX: 0000000000000000 RBX: ffffffffc04c8710 RCX: 0000000000000000 RDX: ffffabef43cdb858 RSI: 0000000000000000 RDI: ffff8d504e850000 RBP: ffff8d506c9f9c00 R08: 0000000000000004 R09: ffff8d506bcd901c R10: 0000000000000015 R11: ffff8d506bcd9000 R12: 0000000000000000 R13: ffffabef43cdb8c0 R14: ffff8d504e850000 R15: 0000000000000000 FS: 00007f2c5462b080(0000) GS:ffff8d575f600000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000000 CR3: 0000000167fd0000 CR4: 00000000007506f0 PKRU: 55555554 Call Trace: <TASK> ? __die+0x20/0x70 ? page_fault_oops+0x15a/0x460 ? sched_balance_find_src_group+0x58d/0xd10 ? exc_page_fault+0x6e/0x180 ? asm_exc_page_fault+0x22/0x30 ? bnxt_get_queue_stats_rx+0xf/0x70 [bnxt_en cdd546fd48563c280cfd30e9647efa420db07bf1] netdev_nl_stats_by_netdev+0x2b1/0x4e0 ? xas_load+0x9/0xb0 ? xas_find+0x183/0x1d0 ? xa_find+0x8b/0xe0 netdev_nl_qstats_get_dumpit+0xbf/0x1e0 genl_dumpit+0x31/0x90 netlink_dump+0x1a8/0x360
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Linux kernel 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于eth bnxt模块在接口关闭时访问空指针。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2025-21973
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2025-21973
请登录查看更多情报信息。
Patches & Fixes for CVE-2025-21973 (2)
Same Patch Batch · Linux · 2025-04-01 · 93 CVEs total
| CVE-2025-21954 | 9.8 CRITICAL | netmem: prevent TX of unreadable skbs |
| CVE-2025-21927 | 9.8 CRITICAL | nvme-tcp: fix potential memory corruption in nvme_tcp_recv_pdu() |
| CVE-2025-21955 | 8.8 HIGH | ksmbd: prevent connection release during oplock break notification |
| CVE-2025-21946 | 8.8 HIGH | ksmbd: fix out-of-bounds in parse_sec_desc() |
| CVE-2025-21945 | 8.8 HIGH | ksmbd: fix use-after-free in smb2_lock |
| CVE-2025-21969 | 8.8 HIGH | Bluetooth: L2CAP: Fix slab-use-after-free Read in l2cap_send_cmd |
| CVE-2025-21967 | 8.8 HIGH | ksmbd: fix use-after-free in ksmbd_free_work_struct |
| CVE-2025-21972 | 8.8 HIGH | net: mctp: unshare packets when reassembling |
| CVE-2025-21947 | 8.1 HIGH | ksmbd: fix type confusion via race condition when using ipc_msg_send_request |
| CVE-2025-21896 | 7.8 HIGH | fuse: revert back to __readahead_folio() for readahead |
| CVE-2025-21949 | 7.8 HIGH | LoongArch: Set hugetlb mmap base address aligned with pmd size |
| CVE-2025-21899 | 7.8 HIGH | tracing: Fix bad hist from corrupting named_triggers list |
| CVE-2025-21979 | 7.8 HIGH | wifi: cfg80211: cancel wiphy_work before freeing wiphy |
| CVE-2025-21966 | 7.8 HIGH | dm-flakey: Fix memory corruption in optional corrupt_bio_byte feature |
| CVE-2025-21926 | 7.8 HIGH | net: gso: fix ownership in __udp_gso_segment |
| CVE-2025-21965 | 7.8 HIGH | sched_ext: Validate prev_cpu in scx_bpf_select_cpu_dfl() |
| CVE-2025-21924 | 7.8 HIGH | net: hns3: make sure ptp clock is unregister and freed if hclge_ptp_get_cycle returns an e |
| CVE-2025-21934 | 7.8 HIGH | rapidio: fix an API misues when rio_add_net() fails |
| CVE-2025-21939 | 7.8 HIGH | drm/xe/hmm: Don't dereference struct page pointers without notifier lock |
| CVE-2025-21958 | 7.8 HIGH | Revert "openvswitch: switch to per-action label counting in conntrack" |
Showing top 20 of 93 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same product: Linux
- CVE-2022-4994
KVM: x86: wean fast IN from emulator_pio_in - CVE-2026-64560
posix-cpu-timers: Prevent UAF caused by non-leader exec() ra - CVE-2026-64559
s390/pkey: Check length in PKEY_VERIFYPROTK ioctl - CVE-2026-64558
s390/pkey: Check length in pkey_pckmo handler implementation - CVE-2026-64556
perf/core: Detach event groups during remove_on_exec
Same vendor: Linux
- CVE-2022-4994
KVM: x86: wean fast IN from emulator_pio_in - CVE-2026-64560
posix-cpu-timers: Prevent UAF caused by non-leader exec() ra - CVE-2026-64559
s390/pkey: Check length in PKEY_VERIFYPROTK ioctl - CVE-2026-64558
s390/pkey: Check length in pkey_pckmo handler implementation - CVE-2026-64556
perf/core: Detach event groups during remove_on_exec
V. Comments for CVE-2025-21973
No comments yet