LiveActive security incident?Get immediate response
CVE Record

CVE-2025-71092: RDMA/bnxt_re: Fix OOB write in bnxt_re_copy_err_stats()

In the Linux kernel, the following vulnerability has been resolved: RDMA/bnxt_re: Fix OOB write in bnxt_re_copy_err_stats() Commit ef56081d1864 ("RDMA/bnxt_re: RoCE related hardware counters update") added three new counters and placed them after BNXT_RE_OUT_OF_SEQ_ERR. BNXT_RE_OUT_OF_SEQ_ERR acts as a boundary marker for allocating hardware statistics with different num_counters values on chip_gen_p5_p7 devices. As a result, BNXT_RE_NUM_STD_COUNTERS are used when allocating hw_stats, which leads to an out-of-bounds write in bnxt_re_copy_err_stats(). The counters BNXT_RE_REQ_CQE_ERROR, BNXT_RE_RESP_CQE_ERROR, and BNXT_RE_RESP_REMOTE_ACCESS_ERRS are applicable to generic hardware, not only p5/p7 devices. Fix this by moving these counters before BNXT_RE_OUT_OF_SEQ_ERR so they are included in the generic counter set.

HighCVSS 7.8Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysishigh

Security readout for executives and security teams

Plain-English summary

A Linux kernel RDMA driver flaw can write beyond allocated memory when copying hardware error statistics. On affected systems, a local low-privileged user could potentially cause kernel compromise, data corruption, or service disruption. The available sources do not establish remote reachability or real-world exploitation.

Executive priority

Prioritize validation and patching on RDMA-enabled Linux infrastructure, especially shared or multi-user hosts. Treat other systems as verification candidates rather than assuming exposure. Escalate promptly where bnxt_re is active because successful exploitation could affect the entire host.

Technical view

The bnxt_re driver allocated a smaller hardware-statistics array because three generic counters were positioned after a generation-specific boundary marker. bnxt_re_copy_err_stats() could consequently write past the allocation. The published fix moves those counters before the boundary so they are included in the generic counter count.

Likely exposure

Exposure is limited to affected Linux kernels where the bnxt_re RDMA driver and relevant statistics path are present. The bundle identifies Linux 6.18-related versions as affected, but its version notation is ambiguous; confirm exact ranges against kernel or distribution guidance.

Exploitation context

The CVSS vector describes local access, low privileges, low complexity, and no user interaction, with potentially high confidentiality, integrity, and availability impact. The CVE is not listed in KEV, and the supplied sources provide no evidence of active exploitation or a public exploit.

Researcher notes

The root cause is counter-enumeration ordering relative to BNXT_RE_OUT_OF_SEQ_ERR, which controls allocation sizing on chip_gen_p5_p7 devices. Three counters intended for generic hardware were excluded from BNXT_RE_NUM_STD_COUNTERS, creating the undersized allocation. The bundle does not describe trigger conditions beyond bnxt_re_copy_err_stats() or demonstrate exploitability.

Mitigation direction

  • Update to a vendor-supported kernel containing the applicable referenced stable fix.
  • Prioritize hosts using the bnxt_re RDMA driver or associated hardware.
  • Check Linux distribution advisories for exact affected and corrected package versions.
  • Where updating is delayed, evaluate disabling unused bnxt_re or RDMA functionality through approved operational procedures.

Validation and detection

  • Inventory running kernel versions across Linux hosts.
  • Identify systems loading or configured to use the bnxt_re driver.
  • Confirm installed kernel packages contain the applicable referenced stable fix.
  • Review kernel logs and monitoring for unexplained memory corruption, crashes, or RDMA driver failures.
Prepared
Confidence
medium
Sources
4

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2025-71092 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
High
CVSS
7.8 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
3Timeline events
0ADP providers
3Source links

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
7.8CVSS 3.1HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9Linux

Vulnerability scoring details

Base CVSS 3.1 score

7.8High
CVSS 3.1 vector shape for CVE-2025-71092Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinuxef56081d1864582a6db50710733416c0510b7826, ef56081d1864582a6db50710733416c0510b7826unaffected
LinuxLinux6.18, 0, 6.18.4, 6.19affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.