Skip to main content

Linux Kernel CVE-2025-39971

HIGH
2025-10-15 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Information Disclosure Linux Red Hat Suse
8.8
CVSS 3.1 · Vendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Share

Severity by source

Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67) PRIMARY
8.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
vuln.today AI
8.8 HIGH

A provisioned VF is a low-privilege local foothold (AV:L/PR:L), the malformed mailbox message is trivial (AC:L), and the VF-to-host escape justifies S:C with high host C/I/A impact.

3.1 AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
SUSE
6.6 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H
Red Hat
7.6 MEDIUM
qualitative

Primary rating from Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67).

CVSS VectorVendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Changed
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

2
Analysis Generated
Jul 30, 2026 - 08:10 vuln.today
CVE Published
Oct 15, 2025 - 08:15 cve.org
HIGH 8.8

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

i40e: fix idx validation in config queues msg

Ensure idx is within range of active/initialized TCs when iterating over vf->ch[idx] in i40e_vc_config_queues_msg().

AnalysisAI

Privilege escalation and host memory corruption in the Linux kernel's i40e Intel Ethernet driver allows a malicious or buggy SR-IOV virtual function to send a crafted 'config queues' mailbox message with an out-of-range channel index, causing out-of-bounds access to the vf->ch[idx] array in i40e_vc_config_queues_msg(). Exploitation crosses the VF-to-host trust boundary (CVSS scope change) and can disclose or corrupt host kernel memory. The issue is fixed upstream across multiple stable trees; no public exploit and no CISA KEV listing exist, and EPSS is low (0.20%, 10th percentile), indicating no public exploit identified at time of analysis.

Technical ContextAI

The i40e driver services Intel Ethernet 700-series controllers (X710/XL710/XXV710) that support SR-IOV, splitting a physical NIC into virtual functions (VFs) assigned to guests. VFs communicate with the host physical-function (PF) driver through a virtchnl mailbox. When a VF sends VIRTCHNL_OP_CONFIG_VSI_QUEUES, the PF iterates over per-VF traffic-class channel structures (vf->ch[idx]). The flaw is a missing bounds check ensuring idx stays within the range of active/initialized TCs, an improper-validation-of-array-index condition (CWE-129 class; NVD lists CWE as N/A). Because the loop index is attacker-influenced via the mailbox message, an out-of-range idx dereferences memory beyond the allocated channel array, in host kernel context.

Affected ProductsAI

The vulnerability affects the Linux kernel i40e driver (Intel Ethernet 700-series / X710/XL710 SR-IOV physical-function driver) in versions prior to the fixed stable releases. No CPE strings or exact version boundaries were provided in the input; the eight git.kernel.org stable commit references (e.g. https://git.kernel.org/stable/c/1fa0aadade34481c567cdf4a897c0d4e4d548bd1 and https://git.kernel.org/stable/c/f1ad24c5abe1eaef69158bac1405a74b3c365115) indicate the fix was backported across several maintained stable branches, so multiple long-term kernel series are impacted until updated. Exact vulnerable version ranges should be confirmed per distribution kernel and the corresponding stable-tree tags.

RemediationAI

Upstream fix available (PR/commit); released patched version not independently confirmed - apply the kernel update that includes the i40e idx-validation fix by tracking the referenced stable commits (git.kernel.org/stable/c/1fa0aadade34481c567cdf4a897c0d4e4d548bd1 through f5f91d164af22e7147130ef8bebbdb28d8ecc6e2) into your distribution kernel, or install the vendor kernel package that cites CVE-2025-39971. As a compensating control where patching must wait, do not assign i40e SR-IOV virtual functions to untrusted guests/tenants, or disable SR-IOV on affected i40e NICs (set sriov_numvfs to 0), accepting the trade-off of losing hardware VF passthrough/network performance for those workloads; restricting VF assignment to trusted VMs removes the attack surface without a full patch. Confirm exact fixed version tags against your kernel series before deploying.

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
Container suse/hpc/warewulf4-x86_64/sle-hpc-node:15.6.17.8.134 Image SLES15-SP6 Image SLES15-SP6-BYOS Image SLES15-SP6-BYOS-Azure Image SLES15-SP6-BYOS-EC2 Image SLES15-SP6-BYOS-GCE Image SLES15-SP6-CHOST-BYOS Image SLES15-SP6-CHOST-BYOS-Aliyun Image SLES15-SP6-CHOST-BYOS-Azure Image SLES15-SP6-CHOST-BYOS-EC2 Image SLES15-SP6-CHOST-BYOS-GCE Image SLES15-SP6-CHOST-BYOS-GDC Image SLES15-SP6-CHOST-BYOS-SAP-CCloud Image SLES15-SP6-EC2 Image SLES15-SP6-EC2-ECS-HVM Image SLES15-SP6-GCE Image SLES15-SP6-HPC-BYOS Image SLES15-SP6-HPC-BYOS-Azure Image SLES15-SP6-HPC-BYOS-EC2 Image SLES15-SP6-HPC-BYOS-GCE Image SLES15-SP6-HPC-EC2 Image SLES15-SP6-HPC-GCE Image SLES15-SP6-Hardened-BYOS Image SLES15-SP6-Hardened-BYOS-Azure Image SLES15-SP6-Hardened-BYOS-EC2 Image SLES15-SP6-Hardened-BYOS-GCE Image SLES15-SP6-SAP Image SLES15-SP6-SAP-Azure Image SLES15-SP6-SAP-EC2 Image SLES15-SP6-SAP-GCE Image SLES15-SP6-SAPCAL Image SLES15-SP6-SAPCAL-Azure Image SLES15-SP6-SAPCAL-EC2 Image SLES15-SP6-SAPCAL-GCE Affected
Container suse/sl-micro/6.0/baremetal-os-container:latest Container suse/sl-micro/6.0/toolbox:latest Affected
Container suse/sl-micro/6.0/base-os-container:2.1.3-7.65 Image SLE-Micro Image SLE-Micro-Azure Image SLE-Micro-BYOS Image SLE-Micro-BYOS-Azure Image SLE-Micro-BYOS-EC2 Image SLE-Micro-BYOS-GCE Image SLE-Micro-EC2 Image SLE-Micro-GCE Affected
Container suse/sl-micro/6.0/kvm-os-container:2.1.3-6.88 Affected
Container suse/sl-micro/6.0/rt-os-container:2.1.3-7.105 Affected

Share

CVE-2025-39971 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy