CVE-2025-39970 (GCVE-0-2025-39970)
Vulnerability from cvelistv5
Published
2025-10-15 07:55
Modified
2026-08-05 12:06
Severity ?
8.8 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Summary
In the Linux kernel, the following vulnerability has been resolved: i40e: fix input validation logic for action_meta Fix condition to check 'greater or equal' to prevent OOB dereference.
References
Impacted products
Vendor Product Version
Linux Linux Version: e284fc280473bed23f2e1ed324e102a48f7d17e1
Version: e284fc280473bed23f2e1ed324e102a48f7d17e1
Version: e284fc280473bed23f2e1ed324e102a48f7d17e1
Version: e284fc280473bed23f2e1ed324e102a48f7d17e1
Version: e284fc280473bed23f2e1ed324e102a48f7d17e1
Version: e284fc280473bed23f2e1ed324e102a48f7d17e1
Version: e284fc280473bed23f2e1ed324e102a48f7d17e1
Version: e284fc280473bed23f2e1ed324e102a48f7d17e1
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "a88c1b2746eccf00e2094b187945f0f1e990b400",
              "status": "affected",
              "version": "e284fc280473bed23f2e1ed324e102a48f7d17e1",
              "versionType": "git"
            },
            {
              "lessThan": "28465770ca3b694286ff9ed6dfd558413f57d98f",
              "status": "affected",
              "version": "e284fc280473bed23f2e1ed324e102a48f7d17e1",
              "versionType": "git"
            },
            {
              "lessThan": "f8c8e11825b24661596fa8db2f0981ba17ed0817",
              "status": "affected",
              "version": "e284fc280473bed23f2e1ed324e102a48f7d17e1",
              "versionType": "git"
            },
            {
              "lessThan": "461e0917eedcd159d87f3ea846754a1e07d7e78a",
              "status": "affected",
              "version": "e284fc280473bed23f2e1ed324e102a48f7d17e1",
              "versionType": "git"
            },
            {
              "lessThan": "3883e9702b6a4945e93b16c070f338a9f5b496f9",
              "status": "affected",
              "version": "e284fc280473bed23f2e1ed324e102a48f7d17e1",
              "versionType": "git"
            },
            {
              "lessThan": "3118f41d8fa57b005f53ec3db2ba5eab1d7ba12b",
              "status": "affected",
              "version": "e284fc280473bed23f2e1ed324e102a48f7d17e1",
              "versionType": "git"
            },
            {
              "lessThan": "560e1683410585fbd5df847f43433c4296f0d222",
              "status": "affected",
              "version": "e284fc280473bed23f2e1ed324e102a48f7d17e1",
              "versionType": "git"
            },
            {
              "lessThan": "9739d5830497812b0bdeaee356ddefbe60830b88",
              "status": "affected",
              "version": "e284fc280473bed23f2e1ed324e102a48f7d17e1",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.17"
            },
            {
              "lessThan": "4.17",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.300",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.245",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.194",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.155",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.109",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.50",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.16.*",
              "status": "unaffected",
              "version": "6.16.10",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.17",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.300",
                  "versionStartIncluding": "4.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.245",
                  "versionStartIncluding": "4.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.194",
                  "versionStartIncluding": "4.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.155",
                  "versionStartIncluding": "4.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.109",
                  "versionStartIncluding": "4.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.50",
                  "versionStartIncluding": "4.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.16.10",
                  "versionStartIncluding": "4.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.17",
                  "versionStartIncluding": "4.17",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ni40e: fix input validation logic for action_meta\n\nFix condition to check \u0027greater or equal\u0027 to prevent OOB dereference."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The attack is delivered over the SR-IOV virtchnl mailbox from a VF the attacker controls (guest VM with VFIO passthrough, or a VF-owning container), not over a network protocol. This is local access to the attacking context rather than remote or adjacent reachability.\nAC:L - The attacker fully controls both `num_tc` (via VIRTCHNL_OP_ENABLE_CHANNELS) and `action_meta` (via ADD/DEL_CLOUD_FILTER), so the off-by-one is hit deterministically on the first try; the `vsi_idx == 0` variant needs no heap grooming at all. The only precondition, spoofchk being disabled, is a standard runtime setting in SR-IOV VM deployments and is required for ADq generally.\nPR:L - The attacker needs the ability to drive the VF\u0027s admin queue \u2014 kernel/root inside the assigned guest or possession of the VFIO device \u2014 which is a low-privileged position relative to the host PF driver being attacked. No host privileges whatsoever are needed.\nUI:N - The malicious VF sends the virtchnl messages on its own initiative; no host administrator or other user action is required at any point.\nS:C - The malicious VF lives in a guest VM (or VF-assigned container) while the corrupted state, wild pointer dereference, and hardware filter programming all occur in the host PF driver\u0027s security authority. Impact extends to the hypervisor and to other VFs/guests sharing the adapter, crossing the guest/host boundary.\nC:H - The bug yields an unbounded OOB read \u2014 `pf-\u003evsi[]` indexed by up to 65535 from a leaked heap pointer\u0027s low bits, i.e. ~512 KB past a small kzalloc\u0027d array \u2014 whose value is then dereferenced. The VF can additionally program hardware cloud filters against the PF\u0027s or another VSI\u0027s seid, enabling interception of host and cross-guest traffic.\nI:H - A VF can reliably add and delete hardware traffic-steering filters on the host PF\u0027s main VSI, tampering with host networking, and the wild `vsi-\u003eback` pointer is used as `\u0026pf-\u003ehw` for admin-queue/MMIO operations, giving corruption potential beyond a pure read. Both effects modify state belonging to a higher security authority.\nA:H - Dereferencing the garbage `struct i40e_vsi *` obtained from the double OOB read (`vsi-\u003eseid`, then `vsi-\u003eback`) will in the general case oops or panic the host kernel, and the subsequent MMIO off a bogus `pf-\u003ehw` can wedge the adapter. A host panic takes down the hypervisor and every guest on it, and the VF can repeat the trigger at will."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:06:39.532Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/a88c1b2746eccf00e2094b187945f0f1e990b400"
        },
        {
          "url": "https://git.kernel.org/stable/c/28465770ca3b694286ff9ed6dfd558413f57d98f"
        },
        {
          "url": "https://git.kernel.org/stable/c/f8c8e11825b24661596fa8db2f0981ba17ed0817"
        },
        {
          "url": "https://git.kernel.org/stable/c/461e0917eedcd159d87f3ea846754a1e07d7e78a"
        },
        {
          "url": "https://git.kernel.org/stable/c/3883e9702b6a4945e93b16c070f338a9f5b496f9"
        },
        {
          "url": "https://git.kernel.org/stable/c/3118f41d8fa57b005f53ec3db2ba5eab1d7ba12b"
        },
        {
          "url": "https://git.kernel.org/stable/c/560e1683410585fbd5df847f43433c4296f0d222"
        },
        {
          "url": "https://git.kernel.org/stable/c/9739d5830497812b0bdeaee356ddefbe60830b88"
        }
      ],
      "title": "i40e: fix input validation logic for action_meta",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-39970",
    "datePublished": "2025-10-15T07:55:53.610Z",
    "dateReserved": "2025-04-16T07:20:57.149Z",
    "dateUpdated": "2026-08-05T12:06:39.532Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.