SB2026040650 - Out-of-bounds write in Linux kernel broadcom bnxt driver

Description

This security bulletin contains information about 1 security vulnerability.

1) Out-of-bounds write (CVE-ID: CVE-2026-31395)

The vulnerability allows a local attacker to cause a denial of service or corrupt kernel memory.

The vulnerability exists due to an out-of-bounds write in bnxt_async_event_process() when processing the ASYNC_EVENT_CMPL_EVENT_ID_DBG_BUF_PRODUCER async event. A local attacker can use a malicious or compromised NIC that supplies a crafted type value to trigger an out-of-bounds access and corrupt kernel memory or cause a crash.

The issue occurs because a firmware-supplied 16-bit type field from DMA-mapped completion ring memory is used directly as an index into bp->bs_trace[] without bounds validation.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/19aa416eed9e4aaf1bbe8da0f7bd9a9be31158c8
• https://git.kernel.org/stable/c/64dcbde7f8f870a4f2d9daf24ffb06f9748b5dd3
• https://git.kernel.org/stable/c/b7c7a275447c6d4bf4a36a134682e2e4e20efd4b