CVE-2025-68770: bnxt_en: Fix XDP_TX path
In the Linux kernel, the following vulnerability has been resolved:
bnxten: Fix XDPTX path
For XDPTX action in bnxtrxxdp(), clearing of the event flags is not correct. bnxtpollwork() -> bnxtrxpkt() -> bnxtrxxdp() may be looping within NAPI and some event flags may be set in earlier iterations. In particular, if BNXTTXEVENT is set earlier indicating some XDPTX packets are ready and pending, it will be cleared if it is XDPTX action again. Normally, we will set BNXTTXEVENT again when we successfully call bnxtxmitxdp(). But if the TX ring has no more room, the flag will not be set. This will cause the TX producer to be ahead but the driver will not hit the TX doorbell.
For multi-buf XDPTX, there is no need to clear the event flags and set BNXTAGGEVENT. The BNXTAGGEVENT flag should have been set earlier in bnxtrxpkt().
The visible symptom of this is that the RX ring associated with the TX XDP ring will eventually become empty and all packets will be dropped. Because this condition will cause the driver to not refill the RX ring seeing that the TX ring has forever pending XDPTX packets.
The fix is to only clear BNXTRXEVENT when we have successfully called bnxtxmitxdp().
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Fix the bnxt_en XDP_TX path so that BNXT_RX_EVENT is cleared only after a successful __bnxt_xmit_xdp() call; do not clear it earlier, since otherwise the TX ring may not refill and XDP_TX packets can remain forever pending.
bnxt_en (BNXT Ethernet driver) BNXT_RX_EVENT flag clearing logic = only clear BNXT_RX_EVENT when we have successfully called __bnxt_xmit_xdp() - Operational
After deploying the driver fix, monitor that the TX ring does not have “forever pending XDP_TX packets” symptoms and that the driver reaches the XDP_TX doorbell/producer updates (i.e., it does not get stuck due to RX/TX event flag handling).
Event History
Frequently Asked Questions
What is the severity of CVE-2025-68770?
The severity of CVE-2025-68770 is considered important due to its potential impact on the XDP_TX path in Linux kernel networking.
How do I fix CVE-2025-68770?
To fix CVE-2025-68770, update your Linux kernel to the latest stable version where the issue has been resolved.
What systems are affected by CVE-2025-68770?
CVE-2025-68770 affects the Linux kernel, specifically systems utilizing the bnxt_en driver for networking.
What happens if CVE-2025-68770 is exploited?
Exploitation of CVE-2025-68770 can lead to loops in the NAPI processing of network packets, affecting system performance.
When was CVE-2025-68770 disclosed?
CVE-2025-68770 was disclosed in 2025, when a vulnerability in the handling of event flags in bnxt_rx_xdp() was identified.