Linux Kernel CVE-2025-39970

Upstream fix available (multiple stable-tree commits); the corrected input validation for action_meta should be pulled in by updating to the latest patched stable kernel for your distribution once your vendor ships the backport - apply the distribution kernel update that references CVE-2025-39970 or the listed git.kernel.org commits (e.g., 28465770ca3b694286ff9ed6dfd558413f57d98f and its stable backports). A released patched version number is not independently confirmed from the provided data, so track your distro's security tracker for the exact kernel build. As a compensating control until patched, restrict CAP_NET_ADMIN and traffic-control/hardware-offload configuration on i40e interfaces to trusted administrators (avoid granting NET_ADMIN inside untrusted containers/namespaces); where feasible, avoid enabling tc hardware offload / cloud filters on i40e NICs, accepting the trade-off of losing hardware-accelerated filtering. These controls limit who can reach the vulnerable code path but do not remove the defect.