Skip to main content

Linux Kernel CVE-2025-39969

HIGH
2025-10-15 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Information Disclosure Linux Red Hat Suse
8.8
CVSS 3.1 · Vendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Share

Severity by source

Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67) PRIMARY
8.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
vuln.today AI
7.9 HIGH

Local VF control gives AV:L/PR:L with low complexity; scope change (S:C) across VF/host justifies elevated confidentiality (C:H), but source 'Information Disclosure' tag makes I/A only Low.

3.1 AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L
4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:L/SC:L/SI:N/SA:N
SUSE
4.4 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
Red Hat
6.5 MEDIUM
qualitative

Primary rating from Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67).

CVSS VectorVendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Changed
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

2
Analysis Generated
Jul 30, 2026 - 08:12 vuln.today
CVE Published
Oct 15, 2025 - 08:15 cve.org
HIGH 8.8

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

i40e: fix validation of VF state in get resources

VF state I40E_VF_STATE_ACTIVE is not the only state in which VF is actually active so it should not be used to determine if a VF is allowed to obtain resources.

Use I40E_VF_STATE_RESOURCES_LOADED that is set only in i40e_vc_get_vf_resources_msg() and cleared during reset.

AnalysisAI

Improper VF-state validation in the Linux kernel's i40e (Intel Ethernet 700-series) driver lets a virtual function request PF resources it should not be able to obtain, because the resource-allocation check keyed on I40E_VF_STATE_ACTIVE rather than the narrower I40E_VF_STATE_RESOURCES_LOADED state. In SR-IOV deployments this can allow a low-privileged local actor controlling a VF to cross the VF/host trust boundary (CVSS scope-change), with claimed high confidentiality, integrity and availability impact. There is no public exploit identified at time of analysis, EPSS is low (0.20%, 10th percentile), and it is not in CISA KEV.

Technical ContextAI

The i40e driver manages Intel Ethernet Controller 700-series NICs (X710/XL710/XXV710 and similar) and supports SR-IOV, exposing Virtual Functions (VFs) that can be assigned to guests/tenants. Communication between a VF and the Physical Function (PF) occurs over the virtual channel (virtchnl) mailbox; i40e_vc_get_vf_resources_msg() is the handler a VF calls to enumerate the resources (queues, vectors, capabilities) allotted to it. The bug is a state-machine/authorization error: I40E_VF_STATE_ACTIVE is set in more circumstances than the point at which a VF is genuinely provisioned, so gating resource retrieval on it is too permissive. The fix instead checks I40E_VF_STATE_RESOURCES_LOADED, which is set only inside i40e_vc_get_vf_resources_msg() and cleared on reset, tightening the precondition. CWE was not assigned by NVD, but the root cause is an improper validation / incorrect authorization on privileged state (CWE-863/CWE-284 class).

Affected ProductsAI

The Linux kernel's in-tree i40e network driver for Intel Ethernet 700-series adapters is affected; exposure is only meaningful when SR-IOV is enabled and VFs are provisioned. NVD does not publish CPE ranges or a single tagged fixed version here - remediation is expressed as eight stable-tree fix commits on git.kernel.org (185745d5, 6128bbc7, 6c3981fd, 877b7e6f, 8e35c80f, a991dc56, e748f1ee, f47876788a23), indicating the fix was backported across multiple maintained stable branches. Exact vulnerable-to-fixed version boundaries should be read from each stable branch containing the referenced commit; no separate vendor advisory URL beyond the kernel.org commit links was provided.

RemediationAI

Upstream fix available (commits/backports); a single released patched tag is not independently confirmed from the provided data - update to the stable kernel release for your branch that includes the relevant i40e fix commit (e.g. 185745d56ec958bf8aa773828213237dfcc32f5a and its stable backports 6128bbc7adc25c87c2f64b5eb66a280b78ef7ab7, 6c3981fd59ef11a75005ac9978f034da5a168b6a, 877b7e6ffc23766448236e8732254534c518ba42, 8e35c80f8570426fe0f0cc92b151ebd835975f22, a991dc56d3e9a2c3db87d0c3f03c24f6595400f1, e748f1ee493f88e38b77363a60499f979d42c58a, f47876788a23de296c42ef9d505b5c1630f0b4b8), or your distribution's kernel update carrying these. As a compensating control until patched, disable SR-IOV on i40e interfaces (set the NIC's sriov_numvfs to 0) or avoid assigning i40e VFs to untrusted guests, which eliminates the attack surface but removes hardware-accelerated NIC partitioning; alternatively marking VFs as trusted/limiting which tenants receive VFs reduces exposure without fully closing it. Coordinate the kernel update with a maintenance reboot since driver code is in-kernel.

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
Container suse/hpc/warewulf4-x86_64/sle-hpc-node:15.6.17.8.134 Image SLES15-SP6 Image SLES15-SP6-BYOS Image SLES15-SP6-BYOS-Azure Image SLES15-SP6-BYOS-EC2 Image SLES15-SP6-BYOS-GCE Image SLES15-SP6-CHOST-BYOS Image SLES15-SP6-CHOST-BYOS-Aliyun Image SLES15-SP6-CHOST-BYOS-Azure Image SLES15-SP6-CHOST-BYOS-EC2 Image SLES15-SP6-CHOST-BYOS-GCE Image SLES15-SP6-CHOST-BYOS-GDC Image SLES15-SP6-CHOST-BYOS-SAP-CCloud Image SLES15-SP6-EC2 Image SLES15-SP6-EC2-ECS-HVM Image SLES15-SP6-GCE Image SLES15-SP6-HPC-BYOS Image SLES15-SP6-HPC-BYOS-Azure Image SLES15-SP6-HPC-BYOS-EC2 Image SLES15-SP6-HPC-BYOS-GCE Image SLES15-SP6-HPC-EC2 Image SLES15-SP6-HPC-GCE Image SLES15-SP6-Hardened-BYOS Image SLES15-SP6-Hardened-BYOS-Azure Image SLES15-SP6-Hardened-BYOS-EC2 Image SLES15-SP6-Hardened-BYOS-GCE Image SLES15-SP6-SAP Image SLES15-SP6-SAP-Azure Image SLES15-SP6-SAP-EC2 Image SLES15-SP6-SAP-GCE Image SLES15-SP6-SAPCAL Image SLES15-SP6-SAPCAL-Azure Image SLES15-SP6-SAPCAL-EC2 Image SLES15-SP6-SAPCAL-GCE Affected
Container suse/sl-micro/6.0/baremetal-os-container:latest Container suse/sl-micro/6.0/toolbox:latest Affected
Container suse/sl-micro/6.0/base-os-container:2.1.3-7.65 Image SLE-Micro Image SLE-Micro-Azure Image SLE-Micro-BYOS Image SLE-Micro-BYOS-Azure Image SLE-Micro-BYOS-EC2 Image SLE-Micro-BYOS-GCE Image SLE-Micro-EC2 Image SLE-Micro-GCE Affected
Container suse/sl-micro/6.0/kvm-os-container:2.1.3-6.88 Affected
Container suse/sl-micro/6.0/rt-os-container:2.1.3-7.105 Affected

Share

CVE-2025-39969 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy