LiveActive security incident?Get immediate response
CVE Record

CVE-2025-38439: bnxt_en: Set DMA unmap len correctly for XDP_REDIRECT

In the Linux kernel, the following vulnerability has been resolved: bnxt_en: Set DMA unmap len correctly for XDP_REDIRECT When transmitting an XDP_REDIRECT packet, call dma_unmap_len_set() with the proper length instead of 0. This bug triggers this warning on a system with IOMMU enabled: WARNING: CPU: 36 PID: 0 at drivers/iommu/dma-iommu.c:842 __iommu_dma_unmap+0x159/0x170 RIP: 0010:__iommu_dma_unmap+0x159/0x170 Code: a8 00 00 00 00 48 c7 45 b0 00 00 00 00 48 c7 45 c8 00 00 00 00 48 c7 45 a0 ff ff ff ff 4c 89 45 b8 4c 89 45 c0 e9 77 ff ff ff <0f> 0b e9 60 ff ff ff e8 8b bf 6a 00 66 66 2e 0f 1f 84 00 00 00 00 RSP: 0018:ff22d31181150c88 EFLAGS: 00010206 RAX: 0000000000002000 RBX: 00000000e13a0000 RCX: 0000000000000000 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 RBP: ff22d31181150cf0 R08: ff22d31181150ca8 R09: 0000000000000000 R10: 0000000000000000 R11: ff22d311d36c9d80 R12: 0000000000001000 R13: ff13544d10645010 R14: ff22d31181150c90 R15: ff13544d0b2bac00 FS: 0000000000000000(0000) GS:ff13550908a00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00005be909dacff8 CR3: 0008000173408003 CR4: 0000000000f71ef0 PKRU: 55555554 Call Trace: <IRQ> ? show_regs+0x6d/0x80 ? __warn+0x89/0x160 ? __iommu_dma_unmap+0x159/0x170 ? report_bug+0x17e/0x1b0 ? handle_bug+0x46/0x90 ? exc_invalid_op+0x18/0x80 ? asm_exc_invalid_op+0x1b/0x20 ? __iommu_dma_unmap+0x159/0x170 ? __iommu_dma_unmap+0xb3/0x170 iommu_dma_unmap_page+0x4f/0x100 dma_unmap_page_attrs+0x52/0x220 ? srso_alias_return_thunk+0x5/0xfbef5 ? xdp_return_frame+0x2e/0xd0 bnxt_tx_int_xdp+0xdf/0x440 [bnxt_en] __bnxt_poll_work_done+0x81/0x1e0 [bnxt_en] bnxt_poll+0xd3/0x1e0 [bnxt_en]

CriticalCVSS 9.8Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysiscritical

Security readout for executives and security teams

Plain-English summary

A Linux bnxt_en network-driver bug records an incorrect DMA unmap length when handling XDP_REDIRECT traffic. On systems using an IOMMU, this can trigger a kernel warning in interrupt processing. The bundle assigns critical severity, but it does not demonstrate the claimed confidentiality, integrity, or availability consequences.

Executive priority

Treat this as an urgent configuration-dependent kernel maintenance issue. Inventory and patch matching network hosts promptly, prioritizing production systems using bnxt_en, XDP_REDIRECT, and IOMMU. The critical CVSS score warrants attention, although the supplied evidence does not substantiate broad remote compromise.

Technical view

During XDP_REDIRECT transmission, bnxt_en set the DMA unmap length to zero. The correction calls dma_unmap_len_set() with the proper packet length, preventing an IOMMU warning from __iommu_dma_unmap. Exposure depends on the affected kernel code, bnxt_en usage, XDP_REDIRECT traffic, and an enabled IOMMU.

Likely exposure

Likely exposure is limited to systems running a listed affected Linux release where bnxt_en handles XDP_REDIRECT traffic, particularly with IOMMU enabled. The bundle lists versions from 5.3 through 6.16, but its flattened version data does not clearly distinguish vulnerable releases from fixed or backported packages.

Exploitation context

CISA KEV status is false, and the supplied sources provide no evidence of active exploitation or a public exploit. They document a reproducible kernel warning, not an established remote compromise path.

Researcher notes

The supplied 9.8 CVSS vector claims network-accessible total confidentiality, integrity, and availability impact. However, the technical description only establishes an incorrect DMA unmap length and IOMMU warning. No CWE, exploit mechanism, crash, memory corruption, or compromise outcome is documented, so impact and reachability require further vendor evidence.

Mitigation direction

  • Identify hosts running listed Linux releases with the bnxt_en driver loaded.
  • Prioritize systems using XDP_REDIRECT and an enabled IOMMU.
  • Apply the vendor or distribution kernel update containing the referenced stable fix.
  • Follow Debian LTS or your distribution advisory for package versions and reboot requirements.

Validation and detection

  • Record kernel versions and distribution package revisions on potentially affected hosts.
  • Confirm whether bnxt_en, XDP_REDIRECT, and IOMMU are present and active.
  • Verify the installed kernel includes the applicable stable commit or distributor backport.
  • After updating, monitor kernel logs for __iommu_dma_unmap warnings during normal XDP_REDIRECT traffic.
Prepared
Confidence
medium
Sources
12

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2025-38439 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Critical
CVSS
9.8 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
3Timeline events
1ADP providers
11Source links

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
9.8CVSS 3.1CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H3.95.9Linux

Vulnerability scoring details

Base CVSS 3.1 score

9.8Critical
CVSS 3.1 vector shape for CVE-2025-38439Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

ADP provider summaries

CVECVE Program Container

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinuxf18c2b77b2e4eec2313d519ba125bd6a069513cf, f18c2b77b2e4eec2313d519ba125bd6a069513cf, f18c2b77b2e4eec2313d519ba125bd6a069513cf, f18c2b77b2e4eec2313d519ba125bd6a069513cf, f18c2b77b2e4eec2313d519ba125bd6a069513cf, f18c2b77b2e4eec2313d519ba125bd6a069513cf, f18c2b77b2e4eec2313d519ba125bd6a069513cf, f18c2b77b2e4eec2313d519ba125bd6a069513cfunaffected
LinuxLinux5.3, 0, 5.4.296, 5.10.240, 5.15.189, 6.1.146, 6.6.99, 6.12.39, 6.15.7, 6.16affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.