CVE-2025-39810

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> bnxt_en: Fix memory corruption when FW resources change during ifdown<br /> <br /> bnxt_set_dflt_rings() assumes that it is always called before any TC has<br /> been created. So it doesn&amp;#39;t take bp-&gt;num_tc into account and assumes<br /> that it is always 0 or 1.<br /> <br /> In the FW resource or capability change scenario, the FW will return<br /> flags in bnxt_hwrm_if_change() that will cause the driver to<br /> reinitialize and call bnxt_cancel_reservations(). This will lead to<br /> bnxt_init_dflt_ring_mode() calling bnxt_set_dflt_rings() and bp-&gt;num_tc<br /> may be greater than 1. This will cause bp-&gt;tx_ring[] to be sized too<br /> small and cause memory corruption in bnxt_alloc_cp_rings().<br /> <br /> Fix it by properly scaling the TX rings by bp-&gt;num_tc in the code<br /> paths mentioned above. Add 2 helper functions to determine<br /> bp-&gt;tx_nr_rings and bp-&gt;tx_nr_rings_per_tc.