Executive Summary

CVE-2025-22108 exposes a buffer descriptor count overflow in the Linux kernel's bnxt_en network driver. The 5‑bit bd_cnt field can exceed its 32‑value limit when CONFIG_MAX_SKB_FRAGS is high, corrupting TX buffer descriptors and causing transmission timeouts. The patch masks bd_cnt to prevent out‑of‑range values, mitigating potential denial‑of‑service via TX stalls.

---

Authoritative CVE Metadata - CVSS Base Score: 8.6 (HIGH) - Published: 2025-04-16T15:16:05.083 - Last Modified: 2026-09-07T16:17:27.353

Original Description: In the Linux kernel, the following vulnerability has been resolved:

bnxt_en: Mask the bd_cnt field in the TX BD properly

The bd_cnt field in the TX BD specifies the total number of BDs for the TX packet. The bd_cnt field has 5 bits and the maximum number supported is 32 with the value 0.

CONFIG_MAX_SKB_FRAGS can be modified and the total number of SKB fragments can approach or exceed the maximum supported by the chip. Add a macro to properly mask the bd_cnt field so that the value 32 will be properly masked and set to 0 in the bd_cnd field.

Without this patch, the out-of-range bd_cnt value will corrupt the TX BD and may cause TX timeout.

The next patch will check for values exceeding 32.

"A life spent making mistakes is not only more honourable but more useful than a life spent in doing nothing."

— Bernard Shaw