VulnerabilityPublished 9 Dec 2025Updated 9 Sep 2026

CVE-2025-40330: Linux kernel · bnxt_en: Shutdown FW DMA in bnxt_shutdown()

Affects Linux kernelSource GCVE Database

Not known to be exploited · fixed in 6.17.0-1007.7~24.04.1 : update Linux kernel when convenient.

Data as of 26 Oct 2026, 17:16 UTC

Severity

Medium

Rated by Threat Radar · No CVSS score from NVD or the CNA

EPSS: 0.2% chance of exploitation in 30 days – higher than 12% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
Patch: Available – fixed in 6.17.0-1007.7~24.04.1, 6.17.0-1008.8~24.04.1, 6.17.0-1008.8 +6

Exploitation evidence

Disclosed: evidence found.
CVE published 9 Dec 2025
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponised: Public exploit code exists in Metasploit or Exploit-DB, or CISA SSVC or the CVSS exploit maturity reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

What to do

Upgrade to a fixed release listed under Affected software.

Patches and advisories

Affected software

Product	Affected	Fixed in
Ubuntu 25.10linux`pkg:deb/ubuntu/linux?arch=source&distro=questing`Other threats	Affected <6.17.0-14.14	Fixed in 6.17.0-14.14
Ubuntu 25.10linux-aws`pkg:deb/ubuntu/linux-aws?arch=source&distro=questing`Other threats	Affected <6.17.0-1007.7	Fixed in 6.17.0-1007.7
Ubuntu 25.10linux-azure`pkg:deb/ubuntu/linux-azure?arch=source&distro=questing`Other threats	Affected <6.17.0-1008.8	Fixed in 6.17.0-1008.8
Ubuntu 25.10linux-azure-fde`pkg:deb/ubuntu/linux-azure-fde?arch=source&distro=questing`Other threats	Affected 6.17.0-1003.3 – 6.17.0-1017.17 10 affected builds	Fixed in–
Ubuntu 25.10linux-gcp`pkg:deb/ubuntu/linux-gcp?arch=source&distro=questing`Other threats	Affected <6.17.0-1007.7	Fixed in 6.17.0-1007.7
Ubuntu 25.10linux-oracle`pkg:deb/ubuntu/linux-oracle?arch=source&distro=questing`Other threats	Affected <6.17.0-1007.7	Fixed in 6.17.0-1007.7

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

AI-suggested

A patch is available and should be applied by updating to the fixed Linux kernel versions as provided by the vendor. After updating, a system reboot is required to apply the changes. The vendor advisory indicates that the issue is fixed in Linux kernel versions 6.17.0-14.14 and later, among others. Users should ensure they upgrade to these or later versions to mitigate the vulnerability. No additional mitigations are specified beyond applying the official fix.

Description

A vulnerability in the Linux kernel's bnxt_en driver was resolved that involved improper shutdown of firmware DMA during the bnxt_shutdown() process. The netif_close() call only stopped packet DMA, but firmware DMA for trace logging could continue, potentially causing memory corruption if a kexec to a new kernel occurred. The fix involves unregistering the driver from the firmware to stop DMA and resetting the function if necessary. This issue affects multiple Linux kernel versions and has been addressed in updated kernel packages.

Impact

If unpatched, the vulnerability could lead to memory corruption in the new kernel after a kexec operation due to firmware DMA continuing after the network interface shutdown. This could destabilize or crash the system. There is no indication of direct remote code execution or privilege escalation, but system stability and integrity are at risk.

Summary

The Linux kernel bnxt_en driver had a vulnerability where the netif_close() call in bnxt_shutdown() stopped only packet DMA but did not stop firmware DMA used for trace logging. This leftover DMA activity could corrupt memory in a new kernel after a kexec operation. The vulnerability was fixed by adding a call to bnxt_hwrm_func_drv_unrgtr() to unregister the driver from the firmware, stopping the firmware DMA. If this call fails, a PCIe function level reset (pcie_flr()) is performed to halt the DMA. This fix prevents memory corruption caused by residual DMA activity during kernel shutdown and reload.

References

Community reviews

Loading reviews…