CVE-2025-38246
A bug in the Linux kernel’s bnxt driver can cause the system to crash when XDP_REDIRECT is used. The crash can lead to a denial of service, but it does not allow attackers to gain privileges or access data. The issue has been fixed in newer kernel releases.
An official fix is available, so this entry is kept for 30 days and then removed automatically.
Who is affected
Linux kernel users running the bnxt driver (e.g., kernel 6.12 and earlier).
Real-world impact
An attacker could trigger a crash by sending traffic that uses XDP_REDIRECT, causing a denial of service on the affected system. The crash would disrupt services but would not grant the attacker additional privileges or data access.
Why this severity
The CVSS score of 9.8 reflects a critical impact: the vulnerability can cause a complete system crash (denial of service) without requiring any special privileges or user interaction. The lack of privilege escalation or user interface makes it a pure crash bug, but the impact on availability is severe.
What to do about it
- 01Upgrade your Linux kernel to a version that includes the bnxt XDP redirect list fix.
- 02Reboot the system to load the new kernel.
NVD-referenced vendor advisory
Timeline
- Jul 9, 2025 · Jul 9, 2025PublishedDisclosed and added to the National Vulnerability Database.
- Jul 30, 2026 · 7d agoAdvisory updatedThe NVD record was last revised.
- Jul 30, 2026 · 6d agoOfficial fix availableA vendor patch or mitigation now exists — see the remediation steps above.