Executive brief
A vulnerability in the Broadcom NetXtreme-E (bnxt_en) network driver for Linux can cause network interfaces to stop processing traffic. The issue occurs when the driver incorrectly handles high-speed packet processing (XDP), leading to a state where the system stops receiving new data because it believes the transmit queue is full. This results in a complete loss of network connectivity for the affected interface, potentially disrupting business operations and service availability.
Technical details
A logic error in the Broadcom bnxt_en driver's XDP_TX path within bnxt_rx_xdp() causes incorrect clearing of event flags. During NAPI polling loops, if BNXT_TX_EVENT is set in an earlier iteration but the TX ring subsequently lacks room, the flag may be cleared without being reset. This prevents the driver from hitting the TX doorbell, causing the TX producer to get ahead of the consumer. Consequently, the driver stops refilling the RX ring because it perceives the TX ring as having permanently pending packets, eventually leading to a complete exhaustion of the RX ring and total packet loss. The fix involves ensuring BNXT_RX_EVENT is only cleared upon a successful call to __bnxt_xmit_xdp().
Affected products
- Linux Linux Kernel 6.8 to 6.12.63, 6.18.2
Timeline
- 2025-12-02: patched: Initial fix authored by Broadcom
- 2026-01-13: advisory: CVE-2025-68770 published