CVE-2024-40919

bnxt_en: Adjust logging of firmware messages in case of released token in __hwrm_send()

MEDIUM

5.5

CVSS Score

Published: July 12, 2024 at 12:25 PM UTC

Updated: June 17, 2026 at 07:46 AM UTC

1 product affected across 1 vendorLinux Kernel

Using Linux by Linux?

Get instant alerts when new vulnerabilities affect Linux - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

MEDIUM5.5

Exploit prediction

EPSS 0.3%

SSVC

No known exploit

Description

In the Linux kernel, the following vulnerability has been resolved: bnxt_en: Adjust logging of firmware messages in case of released token in __hwrm_send() In case of token is released due to token->state == BNXT_HWRM_DEFERRED, released token (set to NULL) is used in log messages. This issue is expected to be prevented by HWRM_ERR_CODE_PF_UNAVAILABLE error code. But this error code is returned by recent firmware. So some firmware may not return it. This may lead to NULL pointer dereference. Adjust this issue by adding token pointer check. Found by Linux Verification Center (linuxtesting.org) with SVACE.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Linux Kernel · Linux

95%

5.17 ≤ v < 6.1.955.17 ≤ v < 6.105.17 ≤ v < 6.6.355.17 ≤ v < 6.9.66.2 ≤ v < 6.6.356.7 ≤ v < 6.9.66.10 rc1 6.10 rc2 6.10 rc38fa4219dba8e621aa1e78dfa7eeab10f55acb3c0

Vendor states this is fixed in 8b65eaeae88d4e9f999e806e196dd887b90bfed9 (fixed)

Vendor states this is fixed in a9b9741854a9fe9df948af49ca5514e0ed0429df (fixed)

Vendor states this is fixed in ca6660c956242623b4cfe9be2a1abc67907c44bf (fixed)

Vendor states this is fixed in cde177fa235cd36f981012504a6376315bac03c9 (fixed)

Vendor states this is fixed in 5.17 (unaffected)

Vendor states this is fixed in 6.1.95 (unaffected)

Vendor states this is fixed in 6.10 (unaffected)

Vendor states this is fixed in 6.6.35 (unaffected)

Vendor states this is fixed in 6.9.6 (unaffected)