CVE-2026-31395

Vulnerability

The Linux kernel's bnxt_en driver for Broadcom NetXtreme Ethernet cards contains an out-of-bounds (OOB) access vulnerability in the ASYNC_EVENT_CMPL_EVENT_ID_DBG_BUF_PRODUCER handler within bnxt_async_event_process(). The handler uses a firmware-supplied 'type' field directly as an index into the bp->bs_trace[] array without validating its bounds. This field is a 16-bit value obtained from DMA-mapped completion ring memory written by the NIC.

Exploitation

An attacker who can control the NIC's DMA output—for example, through a compromised firmware or physical access—can supply any value from 0 to 65535 as the 'type' field. This causes an OOB read/write beyond the allocated bs_trace array. The subsequent call to bnxt_bs_trace_check_wrap() dereferences bs_trace->magic_byte and writes to bs_trace->last_offset and bs_trace->wrapped, leading to kernel memory corruption or a system crash.

Impact

Successful exploitation can lead to kernel heap memory corruption, potentially resulting in a denial of service (system crash) or, with careful manipulation, privilege escalation. The attack requires a compromised or malicious NIC to inject the out-of-range index, limiting the attack surface to environments where the attacker controls the hardware.

Mitigation

The fix adds a bounds check on the 'type' field and defines BNXT_TRACE_MAX as DBG_LOG_BUFFER_FLUSH_REQ_TYPE_ERR_QPC_TRACE + 1 to cover all valid firmware trace types (0x0 through 0xc). The patch has been applied to the stable kernel trees; see references [1], [2], and [3] for the specific commits. Users should update their kernels to the latest stable releases that include this fix.