CVE-2025-39956 (GCVE-0-2025-39956)
Vulnerability from cvelistv5
Published
2025-10-09 09:47
Modified
2026-10-15 22:02
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
igc: don't fail igc_probe() on LED setup error
When igc_led_setup() fails, igc_probe() fails and triggers kernel panic
in free_netdev() since unregister_netdev() is not called. [1]
This behavior can be tested using fault-injection framework, especially
the failslab feature. [2]
Since LED support is not mandatory, treat LED setup failures as
non-fatal and continue probe with a warning message, consequently
avoiding the kernel panic.
[1]
kernel BUG at net/core/dev.c:12047!
Oops: invalid opcode: 0000 [#1] SMP NOPTI
CPU: 0 UID: 0 PID: 937 Comm: repro-igc-led-e Not tainted 6.17.0-rc4-enjuk-tnguy-00865-gc4940196ab02 #64 PREEMPT(voluntary)
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
RIP: 0010:free_netdev+0x278/0x2b0
[...]
Call Trace:
<TASK>
igc_probe+0x370/0x910
local_pci_probe+0x3a/0x80
pci_device_probe+0xd1/0x200
[...]
[2]
#!/bin/bash -ex
FAILSLAB_PATH=/sys/kernel/debug/failslab/
DEVICE=0000:00:05.0
START_ADDR=$(grep " igc_led_setup" /proc/kallsyms \
| awk '{printf("0x%s", $1)}')
END_ADDR=$(printf "0x%x" $((START_ADDR + 0x100)))
echo $START_ADDR > $FAILSLAB_PATH/require-start
echo $END_ADDR > $FAILSLAB_PATH/require-end
echo 1 > $FAILSLAB_PATH/times
echo 100 > $FAILSLAB_PATH/probability
echo N > $FAILSLAB_PATH/ignore-gfp-wait
echo $DEVICE > /sys/bus/pci/drivers/igc/bind
References
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-39956",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-15T21:55:00.586485Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-15T22:02:33.822Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/ethernet/intel/igc/igc.h",
"drivers/net/ethernet/intel/igc/igc_main.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "bec504867acc7315de9cd96ef9161fa52a25abe8",
"status": "affected",
"version": "ea578703b03d5d651b091c39f717dc829155b520",
"versionType": "git"
},
{
"lessThan": "f05e82d8553232cef150a6dbb70ed67d162abb2b",
"status": "affected",
"version": "ea578703b03d5d651b091c39f717dc829155b520",
"versionType": "git"
},
{
"lessThan": "528eb4e19ec0df30d0c9ae4074ce945667dde919",
"status": "affected",
"version": "ea578703b03d5d651b091c39f717dc829155b520",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/ethernet/intel/igc/igc.h",
"drivers/net/ethernet/intel/igc/igc_main.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.9"
},
{
"lessThan": "6.9",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.49",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.16.*",
"status": "unaffected",
"version": "6.16.9",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.17",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.49",
"versionStartIncluding": "6.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.16.9",
"versionStartIncluding": "6.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.17",
"versionStartIncluding": "6.9",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nigc: don\u0027t fail igc_probe() on LED setup error\n\nWhen igc_led_setup() fails, igc_probe() fails and triggers kernel panic\nin free_netdev() since unregister_netdev() is not called. [1]\nThis behavior can be tested using fault-injection framework, especially\nthe failslab feature. [2]\n\nSince LED support is not mandatory, treat LED setup failures as\nnon-fatal and continue probe with a warning message, consequently\navoiding the kernel panic.\n\n[1]\n kernel BUG at net/core/dev.c:12047!\n Oops: invalid opcode: 0000 [#1] SMP NOPTI\n CPU: 0 UID: 0 PID: 937 Comm: repro-igc-led-e Not tainted 6.17.0-rc4-enjuk-tnguy-00865-gc4940196ab02 #64 PREEMPT(voluntary)\n Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014\n RIP: 0010:free_netdev+0x278/0x2b0\n [...]\n Call Trace:\n \u003cTASK\u003e\n igc_probe+0x370/0x910\n local_pci_probe+0x3a/0x80\n pci_device_probe+0xd1/0x200\n [...]\n\n[2]\n #!/bin/bash -ex\n\n FAILSLAB_PATH=/sys/kernel/debug/failslab/\n DEVICE=0000:00:05.0\n START_ADDR=$(grep \" igc_led_setup\" /proc/kallsyms \\\n | awk \u0027{printf(\"0x%s\", $1)}\u0027)\n END_ADDR=$(printf \"0x%x\" $((START_ADDR + 0x100)))\n\n echo $START_ADDR \u003e $FAILSLAB_PATH/require-start\n echo $END_ADDR \u003e $FAILSLAB_PATH/require-end\n echo 1 \u003e $FAILSLAB_PATH/times\n echo 100 \u003e $FAILSLAB_PATH/probability\n echo N \u003e $FAILSLAB_PATH/ignore-gfp-wait\n\n echo $DEVICE \u003e /sys/bus/pci/drivers/igc/bind"
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The vulnerable path is a PCI driver probe reached locally (sysfs bind, module load, PCI rescan/hotplug), and the resulting corrupted-but-registered netdev is exercised through local syscalls (ioctl, socket TX, /proc/net/dev). No remote or adjacent network input reaches `igc_probe()`.\nAC:L - The failure is deterministic once `igc_led_setup()` returns an error \u2014 the commit\u0027s own reproducer makes it fire 100% of the time \u2014 and the required slab-allocation failure is reachable through ordinary memory-exhaustion pressure with no race to win and no unknowable memory layout required.\nPR:L - A low-privileged local user can drive the system-wide slab exhaustion that makes the GFP_KERNEL allocations in `igc_led_setup()`/`led_classdev_register()` fail during any probe event, and every follow-on use-after-free on the gutted-but-registered netdev (packet transmit, `/proc/net/dev` reads, ethtool GET ioctls) is reachable with no privileges at all.\nUI:N - `igc_probe()` runs automatically on device enumeration, module load, or hotplug with no victim action required, and the post-oops UAF state is reachable without any user cooperation.\nS:U - The BUG(), the premature frees and the dangling driver/iomem state all occur inside the kernel\u0027s own security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - `free_netdev()` releases `dev-\u003eethtool`, `dev-\u003e_tx`/`dev-\u003e_rx` queue arrays and the percpu refcount/stats before hitting the BUG_ON, leaving a still-registered net_device whose freed slab objects can be reallocated and read back through unprivileged ethtool/stat/transmit paths, yielding arbitrary kernel heap disclosure.\nI:H - The same dangling `netdev_queue`/`struct ethtool` pointers on a live registered device give a use-after-free write primitive on attacker-sprayable slab memory, plus writes through the iounmap\u0027d MMIO pointer and freed igc rings retained by the still-active adapter.\nA:H - `BUG_ON(dev-\u003ereg_state != NETREG_UNREGISTERED)` fires an invalid-opcode oops that is an immediate panic on `panic_on_oops`/hardened embedded builds, and even when it isn\u0027t the probe thread dies holding `device_lock()`, permanently wedging bind/unbind/rmmod and leaving a netdev whose next use crashes the kernel."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:06:26.765Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/bec504867acc7315de9cd96ef9161fa52a25abe8"
},
{
"url": "https://git.kernel.org/stable/c/f05e82d8553232cef150a6dbb70ed67d162abb2b"
},
{
"url": "https://git.kernel.org/stable/c/528eb4e19ec0df30d0c9ae4074ce945667dde919"
}
],
"title": "igc: don\u0027t fail igc_probe() on LED setup error",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2025-39956",
"datePublished": "2025-10-09T09:47:34.253Z",
"dateReserved": "2025-04-16T07:20:57.149Z",
"dateUpdated": "2026-10-15T22:02:33.822Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"vulnerability-lookup:meta": {
"vulnrichment": {
"containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2025-39956\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-10-15T21:55:00.586485Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-10-15T21:55:01.381Z\"}}], \"cna\": {\"title\": \"igc: don\u0027t fail igc_probe() on LED setup error\", \"metrics\": [{\"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 7.8, \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"AV:L - The vulnerable path is a PCI driver probe reached locally (sysfs bind, module load, PCI rescan/hotplug), and the resulting corrupted-but-registered netdev is exercised through local syscalls (ioctl, socket TX, /proc/net/dev). No remote or adjacent network input reaches `igc_probe()`.\\nAC:L - The failure is deterministic once `igc_led_setup()` returns an error \\u2014 the commit\u0027s own reproducer makes it fire 100% of the time \\u2014 and the required slab-allocation failure is reachable through ordinary memory-exhaustion pressure with no race to win and no unknowable memory layout required.\\nPR:L - A low-privileged local user can drive the system-wide slab exhaustion that makes the GFP_KERNEL allocations in `igc_led_setup()`/`led_classdev_register()` fail during any probe event, and every follow-on use-after-free on the gutted-but-registered netdev (packet transmit, `/proc/net/dev` reads, ethtool GET ioctls) is reachable with no privileges at all.\\nUI:N - `igc_probe()` runs automatically on device enumeration, module load, or hotplug with no victim action required, and the post-oops UAF state is reachable without any user cooperation.\\nS:U - The BUG(), the premature frees and the dangling driver/iomem state all occur inside the kernel\u0027s own security authority; no VM, IOMMU, or sandbox boundary is crossed.\\nC:H - `free_netdev()` releases `dev-\u003eethtool`, `dev-\u003e_tx`/`dev-\u003e_rx` queue arrays and the percpu refcount/stats before hitting the BUG_ON, leaving a still-registered net_device whose freed slab objects can be reallocated and read back through unprivileged ethtool/stat/transmit paths, yielding arbitrary kernel heap disclosure.\\nI:H - The same dangling `netdev_queue`/`struct ethtool` pointers on a live registered device give a use-after-free write primitive on attacker-sprayable slab memory, plus writes through the iounmap\u0027d MMIO pointer and freed igc rings retained by the still-active adapter.\\nA:H - `BUG_ON(dev-\u003ereg_state != NETREG_UNREGISTERED)` fires an invalid-opcode oops that is an immediate panic on `panic_on_oops`/hardened embedded builds, and even when it isn\u0027t the probe thread dies holding `device_lock()`, permanently wedging bind/unbind/rmmod and leaving a netdev whose next use crashes the kernel.\"}]}], \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"ea578703b03d5d651b091c39f717dc829155b520\", \"lessThan\": \"bec504867acc7315de9cd96ef9161fa52a25abe8\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"ea578703b03d5d651b091c39f717dc829155b520\", \"lessThan\": \"f05e82d8553232cef150a6dbb70ed67d162abb2b\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"ea578703b03d5d651b091c39f717dc829155b520\", \"lessThan\": \"528eb4e19ec0df30d0c9ae4074ce945667dde919\", \"versionType\": \"git\"}], \"programFiles\": [\"drivers/net/ethernet/intel/igc/igc.h\", \"drivers/net/ethernet/intel/igc/igc_main.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"6.9\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"6.9\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"6.12.49\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.12.*\"}, {\"status\": \"unaffected\", \"version\": \"6.16.9\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.16.*\"}, {\"status\": \"unaffected\", \"version\": \"6.17\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"drivers/net/ethernet/intel/igc/igc.h\", \"drivers/net/ethernet/intel/igc/igc_main.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/bec504867acc7315de9cd96ef9161fa52a25abe8\"}, {\"url\": \"https://git.kernel.org/stable/c/f05e82d8553232cef150a6dbb70ed67d162abb2b\"}, {\"url\": \"https://git.kernel.org/stable/c/528eb4e19ec0df30d0c9ae4074ce945667dde919\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nigc: don\u0027t fail igc_probe() on LED setup error\\n\\nWhen igc_led_setup() fails, igc_probe() fails and triggers kernel panic\\nin free_netdev() since unregister_netdev() is not called. [1]\\nThis behavior can be tested using fault-injection framework, especially\\nthe failslab feature. [2]\\n\\nSince LED support is not mandatory, treat LED setup failures as\\nnon-fatal and continue probe with a warning message, consequently\\navoiding the kernel panic.\\n\\n[1]\\n kernel BUG at net/core/dev.c:12047!\\n Oops: invalid opcode: 0000 [#1] SMP NOPTI\\n CPU: 0 UID: 0 PID: 937 Comm: repro-igc-led-e Not tainted 6.17.0-rc4-enjuk-tnguy-00865-gc4940196ab02 #64 PREEMPT(voluntary)\\n Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014\\n RIP: 0010:free_netdev+0x278/0x2b0\\n [...]\\n Call Trace:\\n \u003cTASK\u003e\\n igc_probe+0x370/0x910\\n local_pci_probe+0x3a/0x80\\n pci_device_probe+0xd1/0x200\\n [...]\\n\\n[2]\\n #!/bin/bash -ex\\n\\n FAILSLAB_PATH=/sys/kernel/debug/failslab/\\n DEVICE=0000:00:05.0\\n START_ADDR=$(grep \\\" igc_led_setup\\\" /proc/kallsyms \\\\\\n | awk \u0027{printf(\\\"0x%s\\\", $1)}\u0027)\\n END_ADDR=$(printf \\\"0x%x\\\" $((START_ADDR + 0x100)))\\n\\n echo $START_ADDR \u003e $FAILSLAB_PATH/require-start\\n echo $END_ADDR \u003e $FAILSLAB_PATH/require-end\\n echo 1 \u003e $FAILSLAB_PATH/times\\n echo 100 \u003e $FAILSLAB_PATH/probability\\n echo N \u003e $FAILSLAB_PATH/ignore-gfp-wait\\n\\n echo $DEVICE \u003e /sys/bus/pci/drivers/igc/bind\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.12.49\", \"versionStartIncluding\": \"6.9\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.16.9\", \"versionStartIncluding\": \"6.9\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.17\", \"versionStartIncluding\": \"6.9\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-08-05T12:06:26.765Z\"}}}",
"cveMetadata": "{\"cveId\": \"CVE-2025-39956\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-10-15T22:02:33.822Z\", \"dateReserved\": \"2025-04-16T07:20:57.149Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2025-10-09T09:47:34.253Z\", \"assignerShortName\": \"Linux\"}",
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
}
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.
Loading…
Loading…