CVE-2025-71092: 
Linux Debian vulnerability analysis and mitigation

CVE-2025-71092 is an out-of-bounds write vulnerability in the Linux kernel's RDMA/bnxt_re driver, specifically within the bnxt_re_copy_err_stats() function. It was introduced by commit ef56081d1864 ("RDMA/bnxt_re: RoCE related hardware counters update") and affects Linux kernel versions 6.18, 6.18.1 through 6.18.3, and 6.19-rc1 through 6.19-rc8. The CVE was published on January 13, 2026, and received its initial NVD analysis on March 25, 2026. It carries a CVSS v3.1 base score of 7.8 (High) (Feedly, NVD).

The root cause is an out-of-bounds write (CWE-787) caused by a counter ordering error in the RDMA/bnxt_re driver. Commit ef56081d1864 added three new hardware counters — BNXT_RE_REQ_CQE_ERROR, BNXT_RE_RESP_CQE_ERROR, and BNXT_RE_RESP_REMOTE_ACCESS_ERRS — and placed them after BNXT_RE_OUT_OF_SEQ_ERR, which serves as a boundary marker used to determine the number of hardware statistics counters (num_counters) allocated for chip_gen_p5_p7 devices. Because these counters fall outside the boundary, BNXT_RE_NUM_STD_COUNTERS is used during hw_stats allocation, resulting in an undersized buffer that is then written beyond its bounds in bnxt_re_copy_err_stats(). The attack vector is local, requires only low privileges, and no user interaction, making it accessible to any unprivileged local user on an affected system with RDMA hardware (Feedly, NVD).

Successful exploitation of this vulnerability can result in kernel memory corruption, which may lead to privilege escalation, system instability, or a denial of service (kernel crash). A local attacker with low privileges could leverage the out-of-bounds write to overwrite adjacent kernel memory structures, potentially gaining elevated privileges or causing the system to become unavailable. The vulnerability is confined to systems with Broadcom bnxt_re RDMA hardware and the affected kernel versions (Feedly).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time (Feedly). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.018% (0.000180), indicating a very low probability of exploitation in the near term (Feedly). No threat actor attribution has been reported.

The vulnerability has been patched in Linux kernel versions 6.18.4 and 6.19-rc4 (and later). The fix moves the three affected counters (BNXT_RE_REQ_CQE_ERROR, BNXT_RE_RESP_CQE_ERROR, BNXT_RE_RESP_REMOTE_ACCESS_ERRS) before BNXT_RE_OUT_OF_SEQ_ERR so they are included in the generic counter set and correctly sized buffer allocation. Administrators should update to kernel 6.18.4 or later as the primary remediation. As a workaround, restricting local access to systems with RDMA hardware and limiting use of the bnxt_re driver can reduce exposure until patching is feasible (Feedly, kernel.org patch 1, kernel.org patch 2).