CVE-2025-68770: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-68770 is a logic flaw in the Linux kernel's bnxt_en network driver affecting the XDP_TX (eXpress Data Path transmit) code path. The vulnerability was published on January 13, 2026, and stems from incorrect clearing of event flags in the bnxt_rx_xdp() function during NAPI polling loops. Affected versions include Linux kernel builds from commit 7f0a168b0441ef7fd6b46563efb2706c58ac2a4c up to the respective fix commits across stable branches. No CVSS score has been assigned by NVD at this time (NVD).

The root cause is improper state management (logic error) in the bnxt_rx_xdp() function within the bnxt_en Broadcom network driver. During NAPI polling, __bnxt_poll_work() → bnxt_rx_pkt() → bnxt_rx_xdp() may loop multiple times, and event flags set in earlier iterations can be incorrectly cleared. Specifically, if BNXT_TX_EVENT is set (indicating pending XDP_TX packets) and the loop encounters another XDP_TX action, the flag is cleared; if the TX ring is full and __bnxt_xmit_xdp() is not called successfully, the flag is never re-set, causing the TX producer index to advance without triggering the TX doorbell. For multi-buffer XDP_TX, the code also incorrectly clears event flags and sets BNXT_AGG_EVENT, which should have already been set in bnxt_rx_pkt(). The fix restricts clearing of BNXT_RX_EVENT to only occur upon a successful call to __bnxt_xmit_xdp() (NVD).

The primary impact is a denial-of-service condition on systems using Broadcom bnxt_en network adapters with XDP enabled. The RX ring associated with the XDP TX ring gradually empties because the driver fails to refill it — incorrectly believing the TX ring has perpetually pending XDP_TX packets — resulting in all incoming packets being dropped. This affects availability of network services on the impacted host; there is no known confidentiality or integrity impact, and no lateral movement vector has been identified (NVD).

The fix has been applied to multiple Linux kernel stable branches via the following upstream commits: f17e0c1208485b24d61271bc1ddc8f2087e71561, 0373d5c387f24de749cc22e694a14b3a7c7eb515, and 4b83902a1e67ff327ab5c6c65021a03e72c081d6. Patched versions include Linux kernel 6.12.64, 6.18.3, and 6.19-rc2 or later. Downstream distributions including Ubuntu (USN-8177-1, USN-8179-1, USN-8183-1, USN-8184-1, USN-8185-1, USN-8203-1, USN-8245-1, USN-8257-1, USN-8258-1, USN-8260-1, USN-8265-1), SUSE, Debian, and Oracle Linux have issued updated kernel packages. Administrators should update to a patched kernel version; as a temporary workaround, disabling XDP on affected Broadcom bnxt_en interfaces will prevent the condition from occurring (NVD, Ubuntu USN-8177-1).