SB2025100417 - Use-after-free in Linux kernel ethernet broadcom driver
Published: October 4, 2025
Security Bulletin ID
SB2025100417
Severity
Low
Patch available
YES
Number of vulnerabilities
1
Exploitation vector
Local access
Highest impact
Code execution
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 1 security vulnerability.
1) Use-after-free (CVE-ID: CVE-2025-39945)
The vulnerability allows a local user to escalate privileges on the system.
The vulnerability exists due to a use-after-free error within the cnic_cm_stop_bnx2x_hw() function in drivers/net/ethernet/broadcom/cnic.c. A local user can escalate privileges on the system.
Remediation
Install update from vendor's website.
References
- https://git.kernel.org/stable/c/0405055930264ea8fd26f4131466fa7652e5e47d
- https://git.kernel.org/stable/c/0627e1481676669cae2df0d85b5ff13e7d24c390
- https://git.kernel.org/stable/c/6e33a7eed587062ca8161ad1f4584882a860d697
- https://git.kernel.org/stable/c/7b6a5b0a6b392263c3767fc945b311ea04b34bbd
- https://git.kernel.org/stable/c/8eeb2091e72d75df8ceaa2172638d61b4cf8929a
- https://git.kernel.org/stable/c/cfa7d9b1e3a8604afc84e9e51d789c29574fb216
- https://git.kernel.org/stable/c/e1fcd4a9c09feac0902a65615e866dbf22616125
- https://git.kernel.org/stable/c/fde6e73189f40ebcf0633aed2b68e731c25f3aa3