CVE-2025-39769: 
Linux Debian vulnerability analysis and mitigation

CVE-2025-39769 is an improper locking vulnerability in the Linux kernel's bnxt_en network driver that can trigger a lockdep warning during module removal (rmmod). The flaw exists in the bnxt_free_ntp_fltrs() function, where netdev_assert_locked() is incorrectly invoked during bnxt_remove_one() — a context where the netdev is already unregistered and the lock is not required. Affected versions span Linux kernel 6.15 through 6.16.3, as well as 6.17-rc1 and 6.17-rc2. It carries a CVSS v3.1 base score of 5.5 (Medium) (Feedly).

The root cause is classified as CWE-667 (Improper Locking). During normal runtime, bnxt_free_ntp_fltrs() correctly requires the netdev lock, but when called from bnxt_remove_one() during driver unloading, the netdev is already unregistered, making the netdev_assert_locked() assertion inappropriate. The fix replaces this call with netdev_assert_locked_or_invisible(), which suppresses the assertion when the netdev is in an unregistered (invisible) state. The vulnerability is local in nature, requiring low-privileged access to trigger via module unloading operations (Feedly, Kernel Patch 1).

Exploitation of this vulnerability can cause system instability and kernel warnings during bnxt_en driver module removal, with a high availability impact. A local user with low privileges could potentially trigger the lockdep warning, leading to unexpected kernel behavior or denial of service on systems using Broadcom NetXtreme-C/E network adapters. There is no confidentiality or integrity impact; the scope is limited to the affected system (Feedly).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time. The EPSS score is extremely low at 0.018%, reflecting minimal exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Triggering the issue requires local access and the ability to load/unload the bnxt_en kernel module (Feedly).

Patches are available in the Linux kernel stable tree for affected versions (6.15–6.16.3 and 6.17-rc1/rc2). Users should update to Linux kernel 6.16.4 or later, which includes the fix replacing netdev_assert_locked() with netdev_assert_locked_or_invisible() in bnxt_free_ntp_fltrs(). As interim mitigations, administrators should restrict low-privileged user access to kernel module management and minimize unnecessary loading/unloading of the bnxt_en module. Monitor system logs for unexpected kernel warnings related to bnxt_free_ntp_fltrs (Kernel Patch 1, Kernel Patch 2).