LiveActive security incident?Get immediate response
CVE Record

CVE-2024-53209: bnxt_en: Fix receive ring space parameters when XDP is active

In the Linux kernel, the following vulnerability has been resolved: bnxt_en: Fix receive ring space parameters when XDP is active The MTU setting at the time an XDP multi-buffer is attached determines whether the aggregation ring will be used and the rx_skb_func handler. This is done in bnxt_set_rx_skb_mode(). If the MTU is later changed, the aggregation ring setting may need to be changed and it may become out-of-sync with the settings initially done in bnxt_set_rx_skb_mode(). This may result in random memory corruption and crashes as the HW may DMA data larger than the allocated buffer size, such as: BUG: kernel NULL pointer dereference, address: 00000000000003c0 PGD 0 P4D 0 Oops: 0000 [#1] PREEMPT SMP NOPTI CPU: 17 PID: 0 Comm: swapper/17 Kdump: loaded Tainted: G S OE 6.1.0-226bf9805506 #1 Hardware name: Wiwynn Delta Lake PVT BZA.02601.0150/Delta Lake-Class1, BIOS F0E_3A12 08/26/2021 RIP: 0010:bnxt_rx_pkt+0xe97/0x1ae0 [bnxt_en] Code: 8b 95 70 ff ff ff 4c 8b 9d 48 ff ff ff 66 41 89 87 b4 00 00 00 e9 0b f7 ff ff 0f b7 43 0a 49 8b 95 a8 04 00 00 25 ff 0f 00 00 <0f> b7 14 42 48 c1 e2 06 49 03 95 a0 04 00 00 0f b6 42 33f RSP: 0018:ffffa19f40cc0d18 EFLAGS: 00010202 RAX: 00000000000001e0 RBX: ffff8e2c805c6100 RCX: 00000000000007ff RDX: 0000000000000000 RSI: ffff8e2c271ab990 RDI: ffff8e2c84f12380 RBP: ffffa19f40cc0e48 R08: 000000000001000d R09: 974ea2fcddfa4cbf R10: 0000000000000000 R11: ffffa19f40cc0ff8 R12: ffff8e2c94b58980 R13: ffff8e2c952d6600 R14: 0000000000000016 R15: ffff8e2c271ab990 FS: 0000000000000000(0000) GS:ffff8e3b3f840000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00000000000003c0 CR3: 0000000e8580a004 CR4: 00000000007706e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 PKRU: 55555554 Call Trace: <IRQ> __bnxt_poll_work+0x1c2/0x3e0 [bnxt_en] To address the issue, we now call bnxt_set_rx_skb_mode() within bnxt_change_mtu() to properly set the AGG rings configuration and update rx_skb_func based on the new MTU value. Additionally, BNXT_FLAG_NO_AGG_RINGS is cleared at the beginning of bnxt_set_rx_skb_mode() to make sure it gets set or cleared based on the current MTU.

CriticalCVSS 9.8Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysiscritical

Security readout for executives and security teams

Plain-English summary

A Linux network-driver flaw can corrupt kernel memory or crash a system when XDP is active and the interface MTU changes. Exposure depends on using the bnxt_en driver, XDP multi-buffer operation, and the triggering configuration sequence. Although rated CVSS 9.8, the supplied evidence does not demonstrate active exploitation.

Executive priority

Prioritize internet-facing, high-availability, or multi-tenant hosts meeting the bnxt_en, XDP, and MTU-change prerequisites. Patch promptly because kernel memory corruption can cause severe outages and potentially broader impact, but do not assume widespread exposure or active attacks without environment-specific evidence.

Technical view

bnxt_en could retain receive-buffer and aggregation-ring settings derived from the MTU present when XDP was attached. A later MTU change could leave those settings inconsistent, allowing hardware DMA larger than the allocated buffer. The fix recalculates receive mode during MTU changes and resets the no-aggregation flag before reevaluation.

Likely exposure

Likely exposure is concentrated in Linux systems using Broadcom bnxt_en network interfaces with XDP enabled where MTU values may change. Systems without that driver or configuration are unlikely to reach the described failure path. Confirm distribution-specific builds because stable-kernel fixes may be backported without matching upstream version numbers.

Exploitation context

The CVSS vector describes network reachability, but the supplied sources show a configuration-dependent memory-corruption and crash condition, not a proven remote compromise. The prerequisite state involves XDP and a later MTU change. The CVE is not listed as KEV, and no cited source reports active exploitation.

Researcher notes

The core invariant failure is synchronization between MTU-dependent aggregation-ring allocation and rx_skb_func selection. The patch invokes bnxt_set_rx_skb_mode() from bnxt_change_mtu() and clears BNXT_FLAG_NO_AGG_RINGS before recalculation. The supplied crash confirms availability impact; it does not independently prove controlled confidentiality or integrity compromise.

Mitigation direction

  • Install the vendor or distribution kernel update containing the applicable stable fix.
  • Confirm backport status using the running kernel package changelog or vendor advisory.
  • Until patched, avoid changing MTU after attaching XDP where operationally feasible.
  • If update status is unclear, obtain remediation guidance from the Linux distribution or appliance vendor.

Validation and detection

  • Identify systems loading the bnxt_en driver and inventory their running kernel builds.
  • Determine whether XDP is attached to bnxt_en interfaces and whether MTU changes occur.
  • Compare installed kernel packages against vendor advisories and backport records.
  • Review kernel logs for bnxt_rx_pkt faults, NULL dereferences, memory corruption, or unexplained network-host crashes.
  • After updating, verify the fixed kernel is running and repeat approved XDP and MTU regression testing.
Prepared
Confidence
high
Sources
8

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2024-53209 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Critical
CVSS
9.8 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
3Timeline events
1ADP providers
7Source links

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
9.8CVSS 3.1CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H3.95.9Linux

Vulnerability scoring details

Base CVSS 3.1 score

9.8Critical
CVSS 3.1 vector shape for CVE-2024-53209Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

ADP provider summaries

CVECVE Program Container

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux421e02bda0570eeb11636544fe97ec3097d1bb92, 08450ea98ae98d5a35145b675b76db616046ea11, 08450ea98ae98d5a35145b675b76db616046ea11, 08450ea98ae98d5a35145b675b76db616046ea11, 08450ea98ae98d5a35145b675b76db616046ea11, 893096a7e5fd61cb666b4ead2fa69324e1f2aade, 6.1.45, 6.4.10unaffected
LinuxLinux6.5, 0, 6.1.140, 6.6.85, 6.11.11, 6.12.2, 6.13affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.