Checksum Update Issue in Linux Kernel's bnxt Package - CVE-2025-21960
Summary
CVE-2025-21960: In the Linux kernel, the following vulnerability has been resolved: eth: bnxt: do not update checksum in bnxt_xdp_build_skb() The bnxt_rx_pkt() updates ip_summed value at the end if checksum offload is enabled. Affects linux versions < 6.1.133-1. Fixed in 6.1.133-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is a core component of many operating systems, providing essential services for hardware management and system resources. The bnxt package is a driver for Broadcom's NetXtreme Ethernet controllers, enabling efficient network communication. This vulnerability affects the checksum handling in the bnxt driver, potentially leading to incorrect packet processing.
Vulnerability Detail
In the Linux kernel, specifically within the bnxt driver, there is a vulnerability related to the handling of the ip_summed value during packet processing. The function bnxt_xdp_build_skb() erroneously updates the ip_summed value when it is already set by bnxt_rx_pkt(). This redundancy can lead to warnings and unexpected behavior, particularly when checksum offload is enabled. The issue arises when the XDP-MB program returns XDP_PASS, causing the ip_summed value to be incorrectly updated, which may result in packet processing errors and system instability.
How To Fix
Minimum fixed version
6.1.133-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can disable checksum offloading in their network configuration, which may mitigate the issue until a proper update can be applied. This can be done by adjusting the network interface settings, for example: sudo ethtool -K eth0 rx off tx off.
Conclusion
CVE-2025-21960 is a significant vulnerability in the Linux kernel's bnxt driver that can lead to network processing issues. Users are advised to update their systems to the latest patched version to ensure stability and security. Temporary workarounds are available for those unable to update immediately.
See every vulnerability recorded for linux →
FAQ
CVE-2025-21960 is a vulnerability in the Linux kernel's bnxt driver that involves incorrect handling of the ip_summed value during packet processing.
This vulnerability can lead to incorrect packet processing, which may cause network instability and unexpected behavior in applications relying on the bnxt driver.
Yes, a patch is available in version 6.12.20-1 of the Linux package for Debian 13. Users should update to this version or later.
As a temporary measure, you can disable checksum offloading on your network interface to mitigate the issue until you can apply the update.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
