CVE-2026-31395

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

bnxt_en: fix OOB access in DBG_BUF_PRODUCER async event handler

The ASYNC_EVENT_CMPL_EVENT_ID_DBG_BUF_PRODUCER handler in

bnxt_async_event_process() uses a firmware-supplied 'type' field

directly as an index into bp->bs_trace[] without bounds validation.

The 'type' field is a 16-bit value extracted from DMA-mapped completion

ring memory that the NIC writes directly to host RAM. A malicious or

compromised NIC can supply any value from 0 to 65535, causing an

out-of-bounds access into kernel heap memory.

The bnxt_bs_trace_check_wrap() call then dereferences bs_trace->magic_byte

and writes to bs_trace->last_offset and bs_trace->wrapped, leading to

kernel memory corruption or a crash.

Fix by adding a bounds check and defining BNXT_TRACE_MAX as

DBG_LOG_BUFFER_FLUSH_REQ_TYPE_ERR_QPC_TRACE + 1 to cover all currently

defined firmware trace types (0x0 through 0xc).

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References