GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2025-71092 (GCVE-0-2025-71092)

Vulnerability from cvelistv5 – Published: 2026-01-13 15:34 – Updated: 2026-08-05 12:12
VLAI
Title
RDMA/bnxt_re: Fix OOB write in bnxt_re_copy_err_stats()
Summary
In the Linux kernel, the following vulnerability has been resolved: RDMA/bnxt_re: Fix OOB write in bnxt_re_copy_err_stats() Commit ef56081d1864 ("RDMA/bnxt_re: RoCE related hardware counters update") added three new counters and placed them after BNXT_RE_OUT_OF_SEQ_ERR. BNXT_RE_OUT_OF_SEQ_ERR acts as a boundary marker for allocating hardware statistics with different num_counters values on chip_gen_p5_p7 devices. As a result, BNXT_RE_NUM_STD_COUNTERS are used when allocating hw_stats, which leads to an out-of-bounds write in bnxt_re_copy_err_stats(). The counters BNXT_RE_REQ_CQE_ERROR, BNXT_RE_RESP_CQE_ERROR, and BNXT_RE_RESP_REMOTE_ACCESS_ERRS are applicable to generic hardware, not only p5/p7 devices. Fix this by moving these counters before BNXT_RE_OUT_OF_SEQ_ERR so they are included in the generic counter set.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: ef56081d1864582a6db50710733416c0510b7826 , < 369a161c48723f60f06f3510b82ea7d96d0499ab (git)
Affected: ef56081d1864582a6db50710733416c0510b7826 , < 9b68a1cc966bc947d00e4c0df7722d118125aa37 (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.18
Unaffected: 0 , < 6.18 (semver)
Unaffected: 6.18.4 , ≤ 6.18.* (semver)
Unaffected: 6.19 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/infiniband/hw/bnxt_re/hw_counters.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "369a161c48723f60f06f3510b82ea7d96d0499ab",
              "status": "affected",
              "version": "ef56081d1864582a6db50710733416c0510b7826",
              "versionType": "git"
            },
            {
              "lessThan": "9b68a1cc966bc947d00e4c0df7722d118125aa37",
              "status": "affected",
              "version": "ef56081d1864582a6db50710733416c0510b7826",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/infiniband/hw/bnxt_re/hw_counters.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.18"
            },
            {
              "lessThan": "6.18",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.19",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.4",
                  "versionStartIncluding": "6.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19",
                  "versionStartIncluding": "6.18",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/bnxt_re: Fix OOB write in bnxt_re_copy_err_stats()\n\nCommit ef56081d1864 (\"RDMA/bnxt_re: RoCE related hardware counters\nupdate\") added three new counters and placed them after\nBNXT_RE_OUT_OF_SEQ_ERR.\n\nBNXT_RE_OUT_OF_SEQ_ERR acts as a boundary marker for allocating hardware\nstatistics with different num_counters values on chip_gen_p5_p7 devices.\n\nAs a result, BNXT_RE_NUM_STD_COUNTERS are used when allocating\nhw_stats, which leads to an out-of-bounds write in\nbnxt_re_copy_err_stats().\n\nThe counters BNXT_RE_REQ_CQE_ERROR, BNXT_RE_RESP_CQE_ERROR, and\nBNXT_RE_RESP_REMOTE_ACCESS_ERRS are applicable to generic hardware, not\nonly p5/p7 devices.\n\nFix this by moving these counters before BNXT_RE_OUT_OF_SEQ_ERR so they\nare included in the generic counter set."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable routine is reached through a local read of a per-port sysfs hardware-counter file or an RDMA_NLDEV_CMD_STAT_GET netlink request. Remote RoCE traffic can influence counter values but cannot itself invoke the vulnerable statistics refresh.\nAC:L - No race or condition outside the attacker\u0027s control is required; on an affected pre-P5/P7 adapter, an attacker can repeatedly and reliably request statistics. The required driver and supported hardware define the affected component rather than adding attack complexity.\nPR:L - The sysfs counter files are world-readable with mode 0444, and RDMA_NLDEV_CMD_STAT_GET has no RDMA_NL_ADMIN_PERM check. An ordinary unprivileged local user can therefore trigger the overwrite without capabilities or user namespaces.\nUI:N - The attacker directly triggers the vulnerable counter refresh, requiring no action by another user.\nS:U - The corruption occurs within the host kernel reached by the local attacker and does not inherently cross a VM, IOMMU, or other security-authority boundary.\nC:H - The three 64-bit stores cross into an adjacent heap object, enabling corruption of kernel objects that can plausibly be developed into control-flow and arbitrary-memory-access primitives, including disclosure of sensitive kernel memory.\nI:H - The function performs three out-of-bounds 64-bit writes 160, 168, and 176 bytes beyond the allocated counter array. Corruption of an adjacent heap object can support arbitrary kernel modification or code execution.\nA:H - The heap overwrite can corrupt pointers or other critical kernel state, causing an oops, panic, or complete system failure, and the unprivileged attacker can trigger it repeatedly."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:12:00.926Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/369a161c48723f60f06f3510b82ea7d96d0499ab"
        },
        {
          "url": "https://git.kernel.org/stable/c/9b68a1cc966bc947d00e4c0df7722d118125aa37"
        }
      ],
      "title": "RDMA/bnxt_re: Fix OOB write in bnxt_re_copy_err_stats()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-71092",
    "datePublished": "2026-01-13T15:34:53.110Z",
    "dateReserved": "2026-01-13T15:30:19.650Z",
    "dateUpdated": "2026-08-05T12:12:00.926Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-71092",
      "date": "2026-09-17",
      "epss": "0.00131",
      "percentile": "0.03091"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-71092\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-01-13T16:16:08.923\",\"lastModified\":\"2026-07-30T06:24:50.403\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nRDMA/bnxt_re: Fix OOB write in bnxt_re_copy_err_stats()\\n\\nCommit ef56081d1864 (\\\"RDMA/bnxt_re: RoCE related hardware counters\\nupdate\\\") added three new counters and placed them after\\nBNXT_RE_OUT_OF_SEQ_ERR.\\n\\nBNXT_RE_OUT_OF_SEQ_ERR acts as a boundary marker for allocating hardware\\nstatistics with different num_counters values on chip_gen_p5_p7 devices.\\n\\nAs a result, BNXT_RE_NUM_STD_COUNTERS are used when allocating\\nhw_stats, which leads to an out-of-bounds write in\\nbnxt_re_copy_err_stats().\\n\\nThe counters BNXT_RE_REQ_CQE_ERROR, BNXT_RE_RESP_CQE_ERROR, and\\nBNXT_RE_RESP_REMOTE_ACCESS_ERRS are applicable to generic hardware, not\\nonly p5/p7 devices.\\n\\nFix this by moving these counters before BNXT_RE_OUT_OF_SEQ_ERR so they\\nare included in the generic counter set.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\\n\\nRDMA/bnxt_re: Correcci\u00f3n de escritura fuera de l\u00edmites en bnxt_re_copy_err_stats()\\n\\nEl commit ef56081d1864 (\u0027RDMA/bnxt_re: actualizaci\u00f3n de contadores de hardware relacionados con RoCE\u0027) a\u00f1adi\u00f3 tres nuevos contadores y los coloc\u00f3 despu\u00e9s de BNXT_RE_OUT_OF_SEQ_ERR.\\n\\nBNXT_RE_OUT_OF_SEQ_ERR act\u00faa como un marcador de l\u00edmite para la asignaci\u00f3n de estad\u00edsticas de hardware con diferentes valores de num_counters en dispositivos chip_gen_p5_p7.\\n\\nComo resultado, se utilizan BNXT_RE_NUM_STD_COUNTERS al asignar hw_stats, lo que lleva a una escritura fuera de l\u00edmites en bnxt_re_copy_err_stats().\\n\\nLos contadores BNXT_RE_REQ_CQE_ERROR, BNXT_RE_RESP_CQE_ERROR y BNXT_RE_RESP_REMOTE_ACCESS_ERRS son aplicables a hardware gen\u00e9rico, no solo a dispositivos p5/p7.\\n\\nEsto se corrige moviendo estos contadores antes de BNXT_RE_OUT_OF_SEQ_ERR para que se incluyan en el conjunto de contadores gen\u00e9ricos.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/infiniband/hw/bnxt_re/hw_counters.h\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"ef56081d1864582a6db50710733416c0510b7826\",\"lessThan\":\"369a161c48723f60f06f3510b82ea7d96d0499ab\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"ef56081d1864582a6db50710733416c0510b7826\",\"lessThan\":\"9b68a1cc966bc947d00e4c0df7722d118125aa37\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/infiniband/hw/bnxt_re/hw_counters.h\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.18\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.18\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.4\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.19\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-787\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.18.1\",\"versionEndExcluding\":\"6.18.4\",\"matchCriteriaId\":\"036686AC-DC7A-4773-9B77-D9E4937BFDC3\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.18:-:*:*:*:*:*:*\",\"matchCriteriaId\":\"DCE57113-2223-4308-A0F2-5E6ECFBB3C23\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.19:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"17B67AA7-40D6-4AFA-8459-F200F3D7CFD1\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.19:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"C47E4CC9-C826-4FA9-B014-7FE3D9B318B2\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.19:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"F71D92C0-C023-48BD-B3B6-70B638EEE298\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.19:rc4:*:*:*:*:*:*\",\"matchCriteriaId\":\"13580667-0A98-40CC-B29F-D12790B91BDB\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.19:rc5:*:*:*:*:*:*\",\"matchCriteriaId\":\"CAD1FED7-CF48-47BF-AC7D-7B6FA3C065FC\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.19:rc6:*:*:*:*:*:*\",\"matchCriteriaId\":\"3EF854A1-ABB1-4E93-BE9A-44569EC76C0D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.19:rc7:*:*:*:*:*:*\",\"matchCriteriaId\":\"F5DC0CA6-F0AF-4DDF-A882-3DADB9A886A7\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.19:rc8:*:*:*:*:*:*\",\"matchCriteriaId\":\"EB5B7DFC-C36B-45D8-922C-877569FDDF43\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/369a161c48723f60f06f3510b82ea7d96d0499ab\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/9b68a1cc966bc947d00e4c0df7722d118125aa37\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Important",
      "current_release_date": "2026-08-21T11:44:32+00:00",
      "cve": "CVE-2025-71092",
      "id": "CVE-2025-71092",
      "initial_release_date": "2025-01-01T00:00:00+00:00",
      "product_status:known_not_affected": "274",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: Linux kernel (RDMA/bnxt_re): Out-of-bounds write in error statistics handling",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-71092.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-02T01:11:16Z",
      "cve": "CVE-2025-71092",
      "id": "CVE-2025-71092",
      "initial_release_date": "2026-01-14T00:25:31Z",
      "product_status:known_not_affected": "436",
      "product_status:recommended": "27",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2025-71092",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2025-71092.json",
      "version": "13"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.