CVE-2026-31395
Out-of-Bounds Access in Linux bnxt_en Driver Causes Kernel Crash
Publication date: 2026-04-03
Last updated on: 2026-04-03
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| bnxt | linux_kernel | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-UNKNOWN |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in the Linux kernel's bnxt_en driver, specifically in the ASYNC_EVENT_CMPL_EVENT_ID_DBG_BUF_PRODUCER handler within the bnxt_async_event_process() function.
The handler uses a 'type' field supplied by firmware as an index into an array (bp->bs_trace[]) without checking if the index is within valid bounds.
Since the 'type' field is a 16-bit value coming from DMA-mapped memory written by the Network Interface Card (NIC) directly to host RAM, a malicious or compromised NIC can supply any value between 0 and 65535.
This can cause an out-of-bounds access into kernel heap memory, leading to memory corruption or a kernel crash.
The vulnerability is fixed by adding a bounds check on the 'type' field and defining a maximum valid trace type value.
How can this vulnerability impact me? :
This vulnerability can lead to kernel memory corruption or a system crash if exploited.
A malicious or compromised NIC can supply invalid data that causes out-of-bounds memory access, potentially destabilizing the system.
Such instability could result in denial of service or potentially allow an attacker to execute arbitrary code with kernel privileges, depending on further exploitation.
What immediate steps should I take to mitigate this vulnerability?
The vulnerability is fixed by adding a bounds check in the Linux kernel bnxt_en driver to prevent out-of-bounds access in the DBG_BUF_PRODUCER async event handler.
To mitigate this vulnerability immediately, you should update your Linux kernel to a version that includes this fix.