CVE-2025-40330
In the Linux kernel, the following vulnerability has been resolved: bnxt_en: Shutdown FW DMA in bnxt_shutdown() The netif_close() call in bnxt_shutdown() only stops packet DMA. There may be FW DMA for trace logging (recently added) that will continue. If we kexec to a new kernel, the DMA will corrupt memory in the new kernel. Add bnxt_hwrm_func_drv_unrgtr() to unregister the driver from the FW. This will stop the FW DMA. In case the call fails, call pcie_flr() to reset the function and stop the DMA.
Affected versions
Linux kernel versions
6.13
and later are affected. Fixed in
6.17.8,
6.18
and their respective stable series.
References
The following references provide additional information about CVE-2025-40330 including vendor advisories, patch commits, exploit details, and third-party analysis. Links are sourced from the NIST NVD database.
-
PatchKernel patch commithttps://git.kernel.org/stable/c/1a8a15c3f71d1199d510ccba4bc201cbd2204048
-
PatchKernel patch commithttps://git.kernel.org/stable/c/bc7208ca805ae6062f353a4753467d913d963bc6
Frequently asked questions
-
What is CVE-2025-40330?
CVE-2025-40330 is a unscored severity Linux kernel vulnerability . It affects Linux kernel versions from 6.13 onward and has been patched in 6.17.8 and 6.18. CVE-2025-40330 has not been confirmed as actively exploited and is not listed in the CISA KEV catalog.
-
Is there a patch available for CVE-2025-40330?
Yes — CVE-2025-40330 has been patched. Fixed versions include 6.17.8 and 6.18. If you are running Linux kernel 6.13 or later up to the fix versions, apply the relevant patch for your kernel branch.
-
Is CVE-2025-40330 actively exploited?
No — CVE-2025-40330 has not been confirmed as actively exploited. It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.