Security readout for executives and security teams
Plain-English summary
A Linux networking-driver flaw can corrupt an internal list and crash the kernel when the bnxt driver processes XDP_REDIRECT traffic. A crash can interrupt services on affected hosts. The bundle rates it CVSS 9.8, but provides no evidence of data theft, code execution, or exploitation in the wild.
Executive priority
Prioritize internet-facing or availability-critical hosts that combine bnxt networking with XDP_REDIRECT. Schedule expedited kernel remediation and controlled rebooting. Do not infer compromise solely from this CVE; investigate matching crashes, while recognizing that the supplied evidence establishes denial-of-service risk more clearly than confidentiality or integrity loss.
Technical view
The bnxt receive path failed to flush per-CPU XDP redirect lists before returning frames. A later redirect could reuse stale list state, causing list corruption and a kernel BUG during cpu-map enqueue. The supplied trace demonstrates a crash under XDP_REDIRECT testing; broader confidentiality and integrity impact is not demonstrated.
Likely exposure
Exposure appears limited to Linux systems using the bnxt driver with XDP_REDIRECT functionality. Systems without that driver or feature are less likely to reach the faulty path. The supplied affected-version data is ambiguous, so verify distribution kernels by patch status rather than version numbers alone.
Exploitation context
The CVSS vector describes network reachability without privileges or user interaction, but the bundle provides no exploit demonstration or attacker-controlled trigger analysis. The CVE is not listed as KEV, and no cited source reports active exploitation. Treat availability risk as established; other impacts remain unproven.
Researcher notes
The failure is a stale per-CPU redirect-list lifecycle issue in the bnxt XDP receive path. Linked stable commits are the strongest remediation references. The bundle's version list appears incomplete or flattened, and its 9.8 impact claims exceed the demonstrated kernel-crash evidence; distribution-specific applicability requires confirmation.
Mitigation direction
- Install the vendor-supported kernel update containing the applicable stable fix.
- Check distribution advisories because backported fixes may not match upstream version numbers.
- Where operationally acceptable, avoid XDP_REDIRECT on affected bnxt interfaces until patched.
- Follow vendor guidance if an updated kernel is not yet available.
Validation and detection
- Inventory hosts using the bnxt driver and XDP_REDIRECT programs.
- Compare each running kernel against vendor advisories or the linked stable fixes.
- Review kernel logs for list corruption, kernel BUG, bnxt_rx_xdp, or cpu_map_enqueue traces.
- Confirm updated hosts boot the intended kernel and retain required networking behavior.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2025-38246 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Critical
- CVSS
- 9.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H3.95.9LinuxVulnerability scoring details
Base CVSS 3.1 score
9.8CriticalVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/16254aa985d14dee050564c4a3936f3dc096e1f7CVE reference, Linux
- https://git.kernel.org/stable/c/c6665b8f0f58082c480ed8627029f44d046ef2c8CVE reference, Linux
- https://git.kernel.org/stable/c/02bf488d56df9db4f5147280b65d9011e1ab88d2CVE reference, Linux
- https://git.kernel.org/stable/c/9caca6ac0e26cd20efd490d8b3b2ffb1c7c00f6fCVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.