CVE-2025-38186

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

bnxt_en: Fix double invocation of bnxt_ulp_stop()/bnxt_ulp_start()

Before the commit under the Fixes tag below, bnxt_ulp_stop() and

bnxt_ulp_start() were always invoked in pairs. After that commit,

the new bnxt_ulp_restart() can be invoked after bnxt_ulp_stop()

has been called. This may result in the RoCE driver's aux driver

.suspend() method being invoked twice. The 2nd bnxt_re_suspend()

call will crash when it dereferences a NULL pointer:

(NULL ib_device): Handle device suspend call

BUG: kernel NULL pointer dereference, address: 0000000000000b78

PGD 0 P4D 0

Oops: Oops: 0000 [#1] SMP PTI

CPU: 20 UID: 0 PID: 181 Comm: kworker/u96:5 Tainted: G S 6.15.0-rc1 #4 PREEMPT(voluntary)

Tainted: [S]=CPU_OUT_OF_SPEC

Hardware name: Dell Inc. PowerEdge R730/072T6D, BIOS 2.4.3 01/17/2017

Workqueue: bnxt_pf_wq bnxt_sp_task [bnxt_en]

RIP: 0010:bnxt_re_suspend+0x45/0x1f0 [bnxt_re]

Code: 8b 05 a7 3c 5b f5 48 89 44

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References