CVE-2025-40330: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-40330 is a vulnerability in the Linux kernel's bnxt_en network driver that can cause memory corruption when performing a kexec reboot. The issue arises because bnxt_shutdown() only stops packet DMA via netif_close(), but does not stop firmware (FW) DMA used for trace logging, which can corrupt memory in the newly loaded kernel. It was published on December 9, 2025, and affects Linux kernel versions starting from commit 24d694aec139e9e0a31c60993db79bd8ad575afe. Patches are available targeting Linux 6.17.8 and 6.18 (Feedly, ENISA EUVD). No CVSS score has been assigned at this time.

The root cause is improper resource cleanup during system shutdown in the bnxt_en Broadcom Ethernet driver (CWE-404: Improper Resource Shutdown or Release). When bnxt_shutdown() is called — for example, during a kexec — it invokes netif_close() to halt packet DMA, but recently added firmware DMA activity for trace logging is not terminated. The fix adds a call to bnxt_hwrm_func_drv_unrgtr() to unregister the driver from the firmware, stopping FW DMA; if that call fails, pcie_flr() is invoked to perform a PCIe Function Level Reset and forcibly halt the DMA (Feedly, ENISA EUVD). The vulnerability is specific to systems using Broadcom NetXtreme-C/E (bnxt_en) NICs that perform kexec-based reboots.

If exploited or triggered, the ongoing FW DMA activity can write into arbitrary memory regions of the newly loaded kernel after a kexec reboot, resulting in memory corruption. This can lead to kernel panics, system instability, or unpredictable behavior in the new kernel environment, impacting availability. In edge cases, memory corruption could potentially be leveraged to affect the integrity of the newly booted kernel's data structures, though practical exploitation for privilege escalation would be highly complex (Feedly, ENISA EUVD).

The Linux kernel maintainers have released patches addressing this issue in stable branches targeting Linux 6.17.8 and 6.18 (commits 1a8a15c3f71d1199d510ccba4bc201cbd2204048 and bc7208ca805ae6062f353a4753467d913d963bc6) (ENISA EUVD). Administrators running systems with Broadcom NetXtreme-C/E NICs should apply the relevant kernel update as provided by their Linux distribution (e.g., Oracle Linux, as detected by Nessus/Qualys plugins). As a workaround where patching is not immediately possible, avoiding kexec-based reboots on affected systems with bnxt_en NICs can mitigate the risk of memory corruption.