CVE-2025-21961

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

eth: bnxt: fix truesize for mb-xdp-pass case

When mb-xdp is set and return is XDP_PASS, packet is converted from

xdp_buff to sk_buff with xdp_update_skb_shared_info() in

bnxt_xdp_build_skb().

bnxt_xdp_build_skb() passes incorrect truesize argument to

xdp_update_skb_shared_info().

The truesize is calculated as BNXT_RX_PAGE_SIZE * sinfo->nr_frags but

the skb_shared_info was wiped by napi_build_skb() before.

So it stores sinfo->nr_frags before bnxt_xdp_build_skb() and use it

instead of getting skb_shared_info from xdp_get_shared_info_from_buff().

Splat looks like:

------------[ cut here ]------------

WARNING: CPU: 2 PID: 0 at net/core/skbuff.c:6072 skb_try_coalesce+0x504/0x590

Modules linked in: xt_nat xt_tcpudp veth af_packet xt_conntrack nft_chain_nat xt_MASQUERADE nf_conntrack_netlink xfrm_user xt_addrtype nft_coms

CPU: 2 UID: 0 PID: 0 Comm: swapper/2 Not tainted 6.14.0-rc2+ #3

RIP: 0010:skb_try_coalesce+0x504/

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References