Executive brief
A vulnerability was identified in the Linux kernel's be2net network driver, which is used for Emulex OneConnect Ethernet controllers. Under specific conditions involving IPv6 traffic and the OS2BMC feature, the system could experience a crash or instability due to a software error. This could lead to a denial-of-service (DoS) where the affected server becomes unresponsive.
Technical details
A NULL pointer dereference exists in the be2net driver within the be_insert_vlan_in_pkt() function. When be_send_pkt_to_bmc() is called, it passes a NULL value for the wrb_params argument. If the driver then attempts to process a workaround for specific IPv6 packets (intended to prevent Tx stalls), it dereferences this NULL pointer. The fix involves correctly passing the wrb_params from the be_xmit() call site to ensure the pointer is valid during packet processing. This issue primarily affects systems using Emulex benet hardware with OS2BMC features active.
Affected products
- Linux Linux Kernel be2net driver with OS2BMC support
Timeline
- 2025-11-19: patched: Initial patch submitted by Andrey Vatoropin
- 2025-12-04: disclosed: CVE-2025-40264 published
References
- https://git.kernel.org/stable/c/012ee5882b1830db469194466a210768ed207388
- https://git.kernel.org/stable/c/1ecd86ec6efddb59a10c927e8e679f183bb9113e
- https://git.kernel.org/stable/c/48d59b60dd5d7e4c48c077a2008c9dcd7b59bdfe
- https://git.kernel.org/stable/c/4c4741f6e7f2fa4e1486cb61e1c15b9236ec134d
- https://git.kernel.org/stable/c/630360c6724e27f1aa494ba3fffe1e38c4205284
- https://git.kernel.org/stable/c/7d277a7a58578dd62fd546ddaef459ec24ccae36
- https://git.kernel.org/stable/c/ce0a3699244aca3acb659f143c9cb1327b210f89