Skip to main content

Linux Kernel CVE-2025-39972

HIGH
2025-10-15 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Information Disclosure Linux Red Hat Suse
8.8
CVSS 3.1 · Vendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Share

Severity by source

Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67) PRIMARY
8.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
vuln.today AI
8.8 HIGH

VF-local trigger (AV:L, PR:L) crossing into the host PF gives S:C; unvalidated array index enables OOB read/write and host crash, so C:H/I:H/A:H.

3.1 AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
SUSE
6.1 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H
Red Hat
5.3 MEDIUM
qualitative

Primary rating from Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67).

CVSS VectorVendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Changed
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

2
Analysis Generated
Jul 30, 2026 - 08:10 vuln.today
CVE Published
Oct 15, 2025 - 08:15 cve.org
HIGH 8.8

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

i40e: fix idx validation in i40e_validate_queue_map

Ensure idx is within range of active/initialized TCs when iterating over vf->ch[idx] in i40e_validate_queue_map().

AnalysisAI

Out-of-bounds array access in the Linux kernel's Intel i40e Ethernet driver allows a privileged virtual-function (VF) context to trigger memory corruption on the host by supplying an unvalidated traffic-class index. The flaw is in i40e_validate_queue_map(), where idx was not bounded against the number of active/initialized TCs before indexing vf->ch[idx] during SR-IOV channel/ADQ configuration. No public exploit identified at time of analysis; EPSS is low (0.20%) and it is not listed in CISA KEV, but the CVSS:3.1 score of 8.8 with scope change reflects the guest-to-host boundary crossing.

Technical ContextAI

The affected code is the i40e driver, which serves Intel Ethernet 700-series controllers (X710/XL710/XXV710) commonly used in servers with SR-IOV. When a VF requests Application Device Queues (ADQ) / traffic-class channel mapping over the VIRTCHNL control interface, the PF-side handler i40e_validate_queue_map() iterates vf->ch[idx]. The pre-patch code did not confirm idx fell within the range of TCs that were actually active/initialized, so a malicious or malformed VF request could drive idx past the bounds of the vf->ch[] array. The root-cause class (CWE is listed as N/A in the input) is best described as CWE-129, Improper Validation of Array Index, leading to out-of-bounds read and potentially out-of-bounds write of kernel memory. The tags label this as Information Disclosure, consistent with an OOB read leaking adjacent kernel structures, though an OOB access in this context can also crash the host.

Affected ProductsAI

The Linux kernel's i40e (Intel Ethernet 700-series) network driver in its SR-IOV/VF ADQ path is affected. Exact fixed version tags are not provided in the input; instead, eight upstream stable fix commits are referenced (git.kernel.org/stable/c/34dfac0c904829967d500c51f216916ce1452957, /4d5e804a9e19b639b18fd13664dbad3c03c79e61, /50a1e2f50f6c22b93b94eb8d168a1be3c05bf5cd, /6f15a7b34fae75e745bdc2ec05e06ddfd0dd2f3c, /aa68d3c3ac8d1dcec40d52ae27e39f6d32207009, /b6cb93a7ff208f324c7ec581d72995f80e115e0e, /cc4191e8ef40d2249c1b9a8617d22ec8a976b574, /d4e3eaaa3cb3af77836d806c89cd6ebf533a7320), indicating backports across multiple stable series. No specific NVD CPE version range was supplied, so precise vulnerable-version boundaries should be confirmed against each stable branch containing the fix.

RemediationAI

Upstream fix available (multiple stable-tree commits); a specific released patched kernel version is not independently confirmed from the input, so update to the distribution kernel that incorporates commit 34dfac0c9048 (and its sibling backports listed above) for your stable series and rebuild/reboot. As compensating controls where immediate patching is not possible: disable SR-IOV on i40e interfaces (set the NIC's num_vfs to 0), which removes the attack surface entirely at the cost of losing VF passthrough networking; or avoid assigning i40e VFs to untrusted/multi-tenant guests and refrain from using ADQ/traffic-class channel configuration on VFs, which prevents the vulnerable code path from being reached but limits QoS/queue-steering features. Track the specific fixed version in your distribution's kernel advisory before relying on it, and verify via the git.kernel.org stable commit references above.

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
Container suse/hpc/warewulf4-x86_64/sle-hpc-node:15.6.17.8.134 Image SLES15-SP6 Image SLES15-SP6-BYOS Image SLES15-SP6-BYOS-Azure Image SLES15-SP6-BYOS-EC2 Image SLES15-SP6-BYOS-GCE Image SLES15-SP6-CHOST-BYOS Image SLES15-SP6-CHOST-BYOS-Aliyun Image SLES15-SP6-CHOST-BYOS-Azure Image SLES15-SP6-CHOST-BYOS-EC2 Image SLES15-SP6-CHOST-BYOS-GCE Image SLES15-SP6-CHOST-BYOS-GDC Image SLES15-SP6-CHOST-BYOS-SAP-CCloud Image SLES15-SP6-EC2 Image SLES15-SP6-EC2-ECS-HVM Image SLES15-SP6-GCE Image SLES15-SP6-HPC-BYOS Image SLES15-SP6-HPC-BYOS-Azure Image SLES15-SP6-HPC-BYOS-EC2 Image SLES15-SP6-HPC-BYOS-GCE Image SLES15-SP6-HPC-EC2 Image SLES15-SP6-HPC-GCE Image SLES15-SP6-Hardened-BYOS Image SLES15-SP6-Hardened-BYOS-Azure Image SLES15-SP6-Hardened-BYOS-EC2 Image SLES15-SP6-Hardened-BYOS-GCE Image SLES15-SP6-SAP Image SLES15-SP6-SAP-Azure Image SLES15-SP6-SAP-EC2 Image SLES15-SP6-SAP-GCE Image SLES15-SP6-SAPCAL Image SLES15-SP6-SAPCAL-Azure Image SLES15-SP6-SAPCAL-EC2 Image SLES15-SP6-SAPCAL-GCE Affected
Container suse/sl-micro/6.0/baremetal-os-container:latest Container suse/sl-micro/6.0/toolbox:latest Affected
Container suse/sl-micro/6.0/base-os-container:2.1.3-7.65 Image SLE-Micro Image SLE-Micro-Azure Image SLE-Micro-BYOS Image SLE-Micro-BYOS-Azure Image SLE-Micro-BYOS-EC2 Image SLE-Micro-BYOS-GCE Image SLE-Micro-EC2 Image SLE-Micro-GCE Affected
Container suse/sl-micro/6.0/kvm-os-container:2.1.3-6.88 Affected
Container suse/sl-micro/6.0/rt-os-container:2.1.3-7.105 Affected

Share

CVE-2025-39972 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy