CVE-2025-21682

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

eth: bnxt: always recalculate features after XDP clearing, fix null-deref

Recalculate features when XDP is detached.

Before:

# ip li set dev eth0 xdp obj xdp_dummy.bpf.o sec xdp

# ip li set dev eth0 xdp off

# ethtool -k eth0 | grep gro

rx-gro-hw: off [requested on]

After:

# ip li set dev eth0 xdp obj xdp_dummy.bpf.o sec xdp

# ip li set dev eth0 xdp off

# ethtool -k eth0 | grep gro

rx-gro-hw: on

The fact that HW-GRO doesn't get re-enabled automatically is just

a minor annoyance. The real issue is that the features will randomly

come back during another reconfiguration which just happens to invoke

netdev_update_features(). The driver doesn't handle reconfiguring

two things at a time very robustly.

Starting with commit 98ba1d931f61 ("bnxt_en: Fix RSS logic in

__bnxt_reserve_rings()") we only reconfigure the RSS hash table

if the "effective" number of Rx rings has changed. If HW-GRO is

enabled "effect

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References