CVE-2025-38186— bnxt_en: Fix double invocation of bnxt_ulp_stop()/bnxt_ulp_start()
Quick assessment
Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于重复调用ULP停止和启动，可能导致资源管理问题。
Possible ATT&CK Techniques 1 AI
T1059 · Command and Scripting InterpreterAffected Version Matrix 8
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Linux | Linux | 3c163f35bd50314d4e70ed9e83e1d8d83c473325< 6f2cd309492924b8afd2c62aebff815c1119d124 |
affected |
3c163f35bd50314d4e70ed9e83e1d8d83c473325< cca4ffd4a5b768752b91f6f75d77928e47886913 |
affected | ||
3c163f35bd50314d4e70ed9e83e1d8d83c473325< 1e9ac33fa271be0d2480fd732f9642d81542500b |
affected | ||
6.10 |
affected | ||
< 6.10 |
unaffected | ||
6.12.35≤ 6.12.* |
unaffected | ||
6.15.4≤ 6.15.* |
unaffected | ||
6.16≤ * |
unaffected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2025-38186
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
bnxt_en: Fix double invocation of bnxt_ulp_stop()/bnxt_ulp_start()
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved:
bnxt_en: Fix double invocation of bnxt_ulp_stop()/bnxt_ulp_start()
Before the commit under the Fixes tag below, bnxt_ulp_stop() and
bnxt_ulp_start() were always invoked in pairs. After that commit,
the new bnxt_ulp_restart() can be invoked after bnxt_ulp_stop()
has been called. This may result in the RoCE driver's aux driver
.suspend() method being invoked twice. The 2nd bnxt_re_suspend()
call will crash when it dereferences a NULL pointer:
(NULL ib_device): Handle device suspend call
BUG: kernel NULL pointer dereference, address: 0000000000000b78
PGD 0 P4D 0
Oops: Oops: 0000 [#1] SMP PTI
CPU: 20 UID: 0 PID: 181 Comm: kworker/u96:5 Tainted: G S 6.15.0-rc1 #4 PREEMPT(voluntary)
Tainted: [S]=CPU_OUT_OF_SPEC
Hardware name: Dell Inc. PowerEdge R730/072T6D, BIOS 2.4.3 01/17/2017
Workqueue: bnxt_pf_wq bnxt_sp_task [bnxt_en]
RIP: 0010:bnxt_re_suspend+0x45/0x1f0 [bnxt_re]
Code: 8b 05 a7 3c 5b f5 48 89 44 24 18 31 c0 49 8b 5c 24 08 4d 8b 2c 24 e8 ea 06 0a f4 48 c7 c6 04 60 52 c0 48 89 df e8 1b ce f9 ff <48> 8b 83 78 0b 00 00 48 8b 80 38 03 00 00 a8 40 0f 85 b5 00 00 00
RSP: 0018:ffffa2e84084fd88 EFLAGS: 00010246
RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000001
RDX: 0000000000000000 RSI: ffffffffb4b6b934 RDI: 00000000ffffffff
RBP: ffffa1760954c9c0 R08: 0000000000000000 R09: c0000000ffffdfff
R10: 0000000000000001 R11: ffffa2e84084fb50 R12: ffffa176031ef070
R13: ffffa17609775000 R14: ffffa17603adc180 R15: 0000000000000000
FS: 0000000000000000(0000) GS:ffffa17daa397000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000000b78 CR3: 00000004aaa30003 CR4: 00000000003706f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<TASK>
bnxt_ulp_stop+0x69/0x90 [bnxt_en]
bnxt_sp_task+0x678/0x920 [bnxt_en]
? __schedule+0x514/0xf50
process_scheduled_works+0x9d/0x400
worker_thread+0x11c/0x260
? __pfx_worker_thread+0x10/0x10
kthread+0xfe/0x1e0
? __pfx_kthread+0x10/0x10
ret_from_fork+0x2b/0x40
? __pfx_kthread+0x10/0x10
ret_from_fork_asm+0x1a/0x30
Check the BNXT_EN_FLAG_ULP_STOPPED flag and do not proceed if the flag
is already set. This will preserve the original symmetrical
bnxt_ulp_stop() and bnxt_ulp_start().
Also, inside bnxt_ulp_start(), clear the BNXT_EN_FLAG_ULP_STOPPED
flag after taking the mutex to avoid any race condition. And for
symmetry, only proceed in bnxt_ulp_start() if the
BNXT_EN_FLAG_ULP_STOPPED is set.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Linux kernel 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于重复调用ULP停止和启动，可能导致资源管理问题。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2025-38186
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2025-38186
请登录查看更多情报信息。
Same Patch Batch · Linux · 2025-07-04 · 59 CVEs total
| CVE-2025-38209 | 9.8 CRITICAL | nvme-tcp: remove tag set when second admin queue config fails |
| CVE-2025-38211 | 9.8 CRITICAL | RDMA/iwcm: Fix use-after-free of work objects after cm_id destruction |
| CVE-2025-38174 | 8.8 HIGH | thunderbolt: Do not double dequeue a configuration request |
| CVE-2025-38216 | 8.8 HIGH | iommu/vt-d: Restore context entry setup order for aliased devices |
| CVE-2025-38233 | 7.8 HIGH | powerpc64/ftrace: fix clobbered r15 during livepatching |
| CVE-2025-38230 | 7.8 HIGH | jfs: validate AG parameters in dbMount() to prevent crashes |
| CVE-2025-38227 | 7.8 HIGH | media: vidtv: Terminating the subsequent process of initialization failure |
| CVE-2025-38226 | 7.8 HIGH | media: vivid: Change the siize of the composing |
| CVE-2025-38224 | 7.8 HIGH | can: kvaser_pciefd: refine error prone echo_skb_max handling logic |
| CVE-2025-38218 | 7.8 HIGH | f2fs: fix to do sanity check on sit_bitmap_size |
| CVE-2025-38232 | 7.8 HIGH | NFSD: fix race between nfsd registration and exports_proc |
| CVE-2025-38212 | 7.8 HIGH | ipc: fix to protect IPCS lookups using RCU |
| CVE-2025-38175 | 7.8 HIGH | binder: fix yet another UAF in binder_devices |
| CVE-2025-38234 | 7.8 HIGH | sched/rt: Fix race in push_rt_task |
| CVE-2025-38206 | 7.8 HIGH | exfat: fix double free in delayed_free |
| CVE-2025-38204 | 7.8 HIGH | jfs: fix array-index-out-of-bounds read in add_missing_indices |
| CVE-2025-38192 | 7.8 HIGH | net: clear the dst when changing skb protocol |
| CVE-2025-38187 | 7.8 HIGH | drm/nouveau: fix a use-after-free in r535_gsp_rpc_push() |
| CVE-2025-38180 | 7.8 HIGH | net: atm: fix /proc/net/atm/lec handling |
| CVE-2025-38189 | 7.8 HIGH | drm/v3d: Avoid NULL pointer dereference in `v3d_job_update_stats()` |
Showing top 20 of 59 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same product: Linux
-
CVE-2023-7356
Bluetooth: ISO: Copy BASE if service data matches EIR_BAA_SE -
CVE-2026-98869
bpf: Infer zext_dst based on static register liveness analys -
CVE-2026-98868
dm-pcache: reject a kset that overruns its segment -
CVE-2026-98867
dm-pcache: bound the logical key offset from persistent memo -
CVE-2026-98866
sched/cache: Introduce task_struct->sched_cache_grp to fix U
Same vendor: Linux
-
CVE-2023-7356
Bluetooth: ISO: Copy BASE if service data matches EIR_BAA_SE -
CVE-2026-98869
bpf: Infer zext_dst based on static register liveness analys -
CVE-2026-98868
dm-pcache: reject a kset that overruns its segment -
CVE-2026-98867
dm-pcache: bound the logical key offset from persistent memo -
CVE-2026-98866
sched/cache: Introduce task_struct->sched_cache_grp to fix U
V. Comments for CVE-2025-38186
No comments yet