Linux Kernel CVE-2025-39968

Upstream fix available (multiple stable-tree commits; a released patched tagged version is not independently confirmed in the provided data). Apply the kernel update from your distribution that incorporates the i40e 'add max boundary check for VF filters' change, cross-referencing the git.kernel.org commits listed in the references (e.g. https://git.kernel.org/stable/c/02aae5fcdd34c3a55a243d80a1b328a35852a35c and the seven sibling backports) against your distro's changelog. Until patched, compensating controls target the SR-IOV attack surface: only assign VFs to trusted guests, since exploitation requires guest control of a VF; where feasible, avoid SR-IOV passthrough for untrusted tenants and fall back to a paravirtualized/software NIC path (trade-off: reduced network throughput and higher host CPU); and monitor PF filter-table utilization and dmesg for i40e filter-allocation errors to detect abuse. There is no meaningful network-layer block for this, as the trigger is on the internal VF-to-PF virtchnl channel.