Security readout for executives and security teams
Plain-English summary
A flaw in the Linux bnxt Ethernet driver can crash an affected system when transmit processing encounters an error, such as failed DMA mapping. This can disrupt servers or appliances using that driver. The supplied sources do not establish remote triggering, data theft, data modification, or exploitation in the wild.
Executive priority
Prioritize affected, availability-sensitive servers and appliances, especially where an unexpected kernel crash would interrupt critical services. Treat remediation as high priority, but not as an emergency internet-wide compromise: the supplied evidence does not show remote exploitation or active attacks.
Technical view
The bnxt transmit producer index became free-running, but the transmit error path failed to trim it to the ring size. Under error conditions, the resulting invalid index can crash the kernel. The supplied CVSS 3.1 score is 7.8 and assumes local, low-privileged access, although the description explicitly demonstrates only a crash.
Likely exposure
Exposure is limited to affected Linux kernels using the bnxt network driver. The bundle identifies versions including 6.8, 6.12.25, 6.14.4, and 6.15, but its version records are incomplete and duplicative. Confirm affected and fixed package versions through the relevant Linux distribution or appliance vendor.
Exploitation context
The CVE is not listed as KEV in the supplied bundle, and no provided source reports active exploitation. Triggering involves a transmit error condition such as DMA mapping failure. Whether an unprivileged user can reliably induce that condition is not established, so exploitability beyond the CVSS assumptions remains uncertain.
Researcher notes
The clearest supported impact is kernel denial of service on the transmit error path. Although the CVSS vector assigns high confidentiality, integrity, and availability impacts, the supplied description only explains a crash. The precise triggerability, affected branch boundaries, and downstream backport status require vendor-specific verification.
Mitigation direction
- Apply a vendor-supported kernel containing the relevant Linux stable fix.
- Prioritize systems that load the bnxt driver and require high availability.
- Follow distribution or appliance vendor guidance for exact fixed package versions.
- Use normal maintenance safeguards and rollback planning for kernel updates.
Validation and detection
- Record the running kernel and installed kernel package versions.
- Determine whether the bnxt driver is present and loaded on each host.
- Compare vendor package changelogs against CVE-2025-37873 and the referenced fixes.
- After updating, verify the fixed kernel is running and networking remains healthy.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2025-37873 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9LinuxVulnerability scoring details
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/21e70f694bc0dcb40174b0940cc52a7769fc19e0CVE reference, Linux
- https://git.kernel.org/stable/c/3742c55de00266fa7c8fd2c5d61a453d223a9cd1CVE reference, Linux
- https://git.kernel.org/stable/c/12f2d033fae957d84c2c0ce604d2a077e61fa2c0CVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.