Out-of-Range Access Vulnerability in Linux Package: CVE-2025-22112
Summary
DEBIAN-CVE-2025-22112: In the Linux kernel, the following vulnerability has been resolved: eth: bnxt: fix out-of-range access of vnic_info array The bnxt_queue_{start | stop}() access vnic_info as much as allocated, which indicates bp->nr_vnic... Affects linux versions < 6.12.35-1. Fixed in 6.12.35-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux package is a core component of the Debian operating system, providing essential functionalities for managing hardware and system resources. It is widely used in various environments, including servers, desktops, and embedded systems. This package is critical for system stability and performance, making its security paramount. The vulnerability in question affects the handling of virtual network interface cards (vnics), which are crucial for network communication.
Vulnerability Detail
In the Linux kernel, a vulnerability identified as CVE-2025-22112 has been discovered in the bnxt driver. This issue arises from an out-of-range access to the vnic_info array within the bnxt_queue_{start | stop}() functions. The code attempts to access an element beyond the allocated range, specifically reaching bp->vnic_info[bp->nr_vnics], which can lead to undefined behavior, potential crashes, or exploitation by malicious actors. This vulnerability poses a significant risk to systems utilizing the bnxt driver for network operations.
How To Fix
Minimum fixed version
6.12.35-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, no specific workaround has been provided for this vulnerability. It is advisable to apply the patch as soon as it becomes available to mitigate the risk.
Conclusion
The CVE-2025-22112 vulnerability in the Linux kernel poses a significant risk due to its potential for out-of-range access to the vnic_info array. Users are strongly encouraged to update to the patched version 6.12.35-1 to safeguard their systems. Regular monitoring and prompt action are essential to maintain system security.
See every vulnerability recorded for linux →
FAQ
CVE-2025-22112 is a vulnerability in the Linux kernel that allows out-of-range access to the vnic_info array, potentially leading to system instability or exploitation.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without any signup.
The risks include system crashes, undefined behavior, and potential exploitation by attackers, which could compromise system security.
Yes, a patch is available in version 6.12.35-1 of the Linux package. It is crucial to update to this version to mitigate the vulnerability.
If immediate updating is not possible, monitor your system closely for any unusual behavior and consider isolating affected systems from critical networks until the patch can be applied.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
