CVE-2025-39968 (GCVE-0-2025-39968)
Vulnerability from cvelistv5
Published
2025-10-15 07:55
Modified
2026-08-05 12:06
Severity ?
7.3 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:H
Summary
In the Linux kernel, the following vulnerability has been resolved: i40e: add max boundary check for VF filters There is no check for max filters that VF can request. Add it.
References
Impacted products
Vendor Product Version
Linux Linux Version: e284fc280473bed23f2e1ed324e102a48f7d17e1
Version: e284fc280473bed23f2e1ed324e102a48f7d17e1
Version: e284fc280473bed23f2e1ed324e102a48f7d17e1
Version: e284fc280473bed23f2e1ed324e102a48f7d17e1
Version: e284fc280473bed23f2e1ed324e102a48f7d17e1
Version: e284fc280473bed23f2e1ed324e102a48f7d17e1
Version: e284fc280473bed23f2e1ed324e102a48f7d17e1
Version: e284fc280473bed23f2e1ed324e102a48f7d17e1
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "9176e18681cb0d34c5acc87bda224f5652af2ab8",
              "status": "affected",
              "version": "e284fc280473bed23f2e1ed324e102a48f7d17e1",
              "versionType": "git"
            },
            {
              "lessThan": "e490d8c5a54e0dd1ab22417d72c3a7319cf0f030",
              "status": "affected",
              "version": "e284fc280473bed23f2e1ed324e102a48f7d17e1",
              "versionType": "git"
            },
            {
              "lessThan": "77a35be582dff4c80442ebcdce24d45eed8a6ce4",
              "status": "affected",
              "version": "e284fc280473bed23f2e1ed324e102a48f7d17e1",
              "versionType": "git"
            },
            {
              "lessThan": "02aae5fcdd34c3a55a243d80a1b328a35852a35c",
              "status": "affected",
              "version": "e284fc280473bed23f2e1ed324e102a48f7d17e1",
              "versionType": "git"
            },
            {
              "lessThan": "edecce7abd7152b48e279b4fa0a883d1839bb577",
              "status": "affected",
              "version": "e284fc280473bed23f2e1ed324e102a48f7d17e1",
              "versionType": "git"
            },
            {
              "lessThan": "d33e5d6631ac4fddda235a7815babc9d3f124299",
              "status": "affected",
              "version": "e284fc280473bed23f2e1ed324e102a48f7d17e1",
              "versionType": "git"
            },
            {
              "lessThan": "8b13df5aa877b9e4541e301a58a84c42d84d2d9a",
              "status": "affected",
              "version": "e284fc280473bed23f2e1ed324e102a48f7d17e1",
              "versionType": "git"
            },
            {
              "lessThan": "cb79fa7118c150c3c76a327894bb2eb878c02619",
              "status": "affected",
              "version": "e284fc280473bed23f2e1ed324e102a48f7d17e1",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.17"
            },
            {
              "lessThan": "4.17",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.300",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.245",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.194",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.155",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.109",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.50",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.16.*",
              "status": "unaffected",
              "version": "6.16.10",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.17",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.300",
                  "versionStartIncluding": "4.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.245",
                  "versionStartIncluding": "4.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.194",
                  "versionStartIncluding": "4.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.155",
                  "versionStartIncluding": "4.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.109",
                  "versionStartIncluding": "4.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.50",
                  "versionStartIncluding": "4.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.16.10",
                  "versionStartIncluding": "4.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.17",
                  "versionStartIncluding": "4.17",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ni40e: add max boundary check for VF filters\n\nThere is no check for max filters that VF can request. Add it."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The trigger is a `VIRTCHNL_OP_ADD_CLOUD_FILTER` message on the SR-IOV VF\u2192PF admin-queue mailbox, a PCIe transport rather than a network protocol. The attacker needs local control of an assigned VF \u2014 kernel/root inside a guest VM, or possession of the VFIO device \u2014 so reachability is local, not network or adjacent.\nAC:L - The attacker simply loops `VIRTCHNL_OP_ADD_CLOUD_FILTER` with a filter matching its own MAC; there is no duplicate check, no race, and no memory grooming, so growth is deterministic from the first message. The only precondition \u2014 ADq enabled with spoofchk off \u2014 is inherent to any ADq-capable SR-IOV deployment and is a standard runtime configuration.\nPR:L - Only the ability to drive the VF\u0027s admin queue is needed, which is a low-privileged position relative to the host PF driver under attack, and no host privileges of any kind are required. Notably `i40e_validate_cloud_filter()` accepts basic-mode filters from an untrusted VF, so even the trusted-VF bit is unnecessary.\nUI:N - The malicious VF drives the entire message flood on its own initiative. No host administrator or other user action is required at exploitation time.\nS:C - The attacking VF resides in a guest VM (or VF-assigned container) while the unbounded allocations, leaked memory, service-task starvation and hardware filter-table exhaustion all land in the host PF driver\u0027s security authority. The damage extends to the host and to every other VF sharing the adapter, crossing the guest/host and inter-tenant SR-IOV boundary.\nC:N - The defect is a missing upper bound on counted allocations; there is no out-of-bounds read, no uninitialized data returned, and the VF only ever receives an `aq_ret` status code. The `u16` counter wrap has no consumers, so no memory contents are exposed.\nI:L - Each successful add emits an unratelimited `dev_info()` from `i40e_add_del_cloud_filter()`, so a guest can push tens of thousands of lines through the host kernel log and roll away the host\u0027s diagnostic and audit records, and can also monopolize the PF-wide hardware cloud-filter table so the host\u0027s and other tenants\u0027 legitimate steering rules fail to install. The attacker has no control over which host data is displaced, so the modification is limited rather than arbitrary.\nA:H - A guest can allocate `struct i40e_cloud_filter` objects without limit until the host OOMs, and because `i40e_free_vf_res()`/`i40e_free_vfs()` never walk `vf-\u003ecloud_filter_list`, the memory is permanently leaked across every VF reset and SR-IOV teardown. The flood also monopolizes the PF\u0027s single service-task workqueue with synchronous firmware AQ round-trips, stalling watchdog, link and reset handling and taking host networking \u2014 and thus every guest on the adapter \u2014 down with it."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:06:37.397Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/9176e18681cb0d34c5acc87bda224f5652af2ab8"
        },
        {
          "url": "https://git.kernel.org/stable/c/e490d8c5a54e0dd1ab22417d72c3a7319cf0f030"
        },
        {
          "url": "https://git.kernel.org/stable/c/77a35be582dff4c80442ebcdce24d45eed8a6ce4"
        },
        {
          "url": "https://git.kernel.org/stable/c/02aae5fcdd34c3a55a243d80a1b328a35852a35c"
        },
        {
          "url": "https://git.kernel.org/stable/c/edecce7abd7152b48e279b4fa0a883d1839bb577"
        },
        {
          "url": "https://git.kernel.org/stable/c/d33e5d6631ac4fddda235a7815babc9d3f124299"
        },
        {
          "url": "https://git.kernel.org/stable/c/8b13df5aa877b9e4541e301a58a84c42d84d2d9a"
        },
        {
          "url": "https://git.kernel.org/stable/c/cb79fa7118c150c3c76a327894bb2eb878c02619"
        }
      ],
      "title": "i40e: add max boundary check for VF filters",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-39968",
    "datePublished": "2025-10-15T07:55:52.272Z",
    "dateReserved": "2025-04-16T07:20:57.149Z",
    "dateUpdated": "2026-08-05T12:06:37.397Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.