CVE-2025-39970 (GCVE-0-2025-39970)

Vulnerability from cvelistv5 – Published: 2025-10-15 07:55 – Updated: 2026-08-05 12:06
VLAI
Title
i40e: fix input validation logic for action_meta
Summary
In the Linux kernel, the following vulnerability has been resolved: i40e: fix input validation logic for action_meta Fix condition to check 'greater or equal' to prevent OOB dereference.
Severity
8.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: e284fc280473bed23f2e1ed324e102a48f7d17e1 , < a88c1b2746eccf00e2094b187945f0f1e990b400 (git)
Affected: e284fc280473bed23f2e1ed324e102a48f7d17e1 , < 28465770ca3b694286ff9ed6dfd558413f57d98f (git)
Affected: e284fc280473bed23f2e1ed324e102a48f7d17e1 , < f8c8e11825b24661596fa8db2f0981ba17ed0817 (git)
Affected: e284fc280473bed23f2e1ed324e102a48f7d17e1 , < 461e0917eedcd159d87f3ea846754a1e07d7e78a (git)
Affected: e284fc280473bed23f2e1ed324e102a48f7d17e1 , < 3883e9702b6a4945e93b16c070f338a9f5b496f9 (git)
Affected: e284fc280473bed23f2e1ed324e102a48f7d17e1 , < 3118f41d8fa57b005f53ec3db2ba5eab1d7ba12b (git)
Affected: e284fc280473bed23f2e1ed324e102a48f7d17e1 , < 560e1683410585fbd5df847f43433c4296f0d222 (git)
Affected: e284fc280473bed23f2e1ed324e102a48f7d17e1 , < 9739d5830497812b0bdeaee356ddefbe60830b88 (git)
Create a notification for this product.
Linux Linux Affected: 4.17
Unaffected: 0 , < 4.17 (semver)
Unaffected: 5.4.300 , ≤ 5.4.* (semver)
Unaffected: 5.10.245 , ≤ 5.10.* (semver)
Unaffected: 5.15.194 , ≤ 5.15.* (semver)
Unaffected: 6.1.155 , ≤ 6.1.* (semver)
Unaffected: 6.6.109 , ≤ 6.6.* (semver)
Unaffected: 6.12.50 , ≤ 6.12.* (semver)
Unaffected: 6.16.10 , ≤ 6.16.* (semver)
Unaffected: 6.17 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "a88c1b2746eccf00e2094b187945f0f1e990b400",
              "status": "affected",
              "version": "e284fc280473bed23f2e1ed324e102a48f7d17e1",
              "versionType": "git"
            },
            {
              "lessThan": "28465770ca3b694286ff9ed6dfd558413f57d98f",
              "status": "affected",
              "version": "e284fc280473bed23f2e1ed324e102a48f7d17e1",
              "versionType": "git"
            },
            {
              "lessThan": "f8c8e11825b24661596fa8db2f0981ba17ed0817",
              "status": "affected",
              "version": "e284fc280473bed23f2e1ed324e102a48f7d17e1",
              "versionType": "git"
            },
            {
              "lessThan": "461e0917eedcd159d87f3ea846754a1e07d7e78a",
              "status": "affected",
              "version": "e284fc280473bed23f2e1ed324e102a48f7d17e1",
              "versionType": "git"
            },
            {
              "lessThan": "3883e9702b6a4945e93b16c070f338a9f5b496f9",
              "status": "affected",
              "version": "e284fc280473bed23f2e1ed324e102a48f7d17e1",
              "versionType": "git"
            },
            {
              "lessThan": "3118f41d8fa57b005f53ec3db2ba5eab1d7ba12b",
              "status": "affected",
              "version": "e284fc280473bed23f2e1ed324e102a48f7d17e1",
              "versionType": "git"
            },
            {
              "lessThan": "560e1683410585fbd5df847f43433c4296f0d222",
              "status": "affected",
              "version": "e284fc280473bed23f2e1ed324e102a48f7d17e1",
              "versionType": "git"
            },
            {
              "lessThan": "9739d5830497812b0bdeaee356ddefbe60830b88",
              "status": "affected",
              "version": "e284fc280473bed23f2e1ed324e102a48f7d17e1",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.17"
            },
            {
              "lessThan": "4.17",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.300",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.245",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.194",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.155",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.109",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.50",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.16.*",
              "status": "unaffected",
              "version": "6.16.10",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.17",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.300",
                  "versionStartIncluding": "4.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.245",
                  "versionStartIncluding": "4.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.194",
                  "versionStartIncluding": "4.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.155",
                  "versionStartIncluding": "4.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.109",
                  "versionStartIncluding": "4.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.50",
                  "versionStartIncluding": "4.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.16.10",
                  "versionStartIncluding": "4.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.17",
                  "versionStartIncluding": "4.17",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ni40e: fix input validation logic for action_meta\n\nFix condition to check \u0027greater or equal\u0027 to prevent OOB dereference."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The attack is delivered over the SR-IOV virtchnl mailbox from a VF the attacker controls (guest VM with VFIO passthrough, or a VF-owning container), not over a network protocol. This is local access to the attacking context rather than remote or adjacent reachability.\nAC:L - The attacker fully controls both `num_tc` (via VIRTCHNL_OP_ENABLE_CHANNELS) and `action_meta` (via ADD/DEL_CLOUD_FILTER), so the off-by-one is hit deterministically on the first try; the `vsi_idx == 0` variant needs no heap grooming at all. The only precondition, spoofchk being disabled, is a standard runtime setting in SR-IOV VM deployments and is required for ADq generally.\nPR:L - The attacker needs the ability to drive the VF\u0027s admin queue \u2014 kernel/root inside the assigned guest or possession of the VFIO device \u2014 which is a low-privileged position relative to the host PF driver being attacked. No host privileges whatsoever are needed.\nUI:N - The malicious VF sends the virtchnl messages on its own initiative; no host administrator or other user action is required at any point.\nS:C - The malicious VF lives in a guest VM (or VF-assigned container) while the corrupted state, wild pointer dereference, and hardware filter programming all occur in the host PF driver\u0027s security authority. Impact extends to the hypervisor and to other VFs/guests sharing the adapter, crossing the guest/host boundary.\nC:H - The bug yields an unbounded OOB read \u2014 `pf-\u003evsi[]` indexed by up to 65535 from a leaked heap pointer\u0027s low bits, i.e. ~512 KB past a small kzalloc\u0027d array \u2014 whose value is then dereferenced. The VF can additionally program hardware cloud filters against the PF\u0027s or another VSI\u0027s seid, enabling interception of host and cross-guest traffic.\nI:H - A VF can reliably add and delete hardware traffic-steering filters on the host PF\u0027s main VSI, tampering with host networking, and the wild `vsi-\u003eback` pointer is used as `\u0026pf-\u003ehw` for admin-queue/MMIO operations, giving corruption potential beyond a pure read. Both effects modify state belonging to a higher security authority.\nA:H - Dereferencing the garbage `struct i40e_vsi *` obtained from the double OOB read (`vsi-\u003eseid`, then `vsi-\u003eback`) will in the general case oops or panic the host kernel, and the subsequent MMIO off a bogus `pf-\u003ehw` can wedge the adapter. A host panic takes down the hypervisor and every guest on it, and the VF can repeat the trigger at will."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:06:39.532Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/a88c1b2746eccf00e2094b187945f0f1e990b400"
        },
        {
          "url": "https://git.kernel.org/stable/c/28465770ca3b694286ff9ed6dfd558413f57d98f"
        },
        {
          "url": "https://git.kernel.org/stable/c/f8c8e11825b24661596fa8db2f0981ba17ed0817"
        },
        {
          "url": "https://git.kernel.org/stable/c/461e0917eedcd159d87f3ea846754a1e07d7e78a"
        },
        {
          "url": "https://git.kernel.org/stable/c/3883e9702b6a4945e93b16c070f338a9f5b496f9"
        },
        {
          "url": "https://git.kernel.org/stable/c/3118f41d8fa57b005f53ec3db2ba5eab1d7ba12b"
        },
        {
          "url": "https://git.kernel.org/stable/c/560e1683410585fbd5df847f43433c4296f0d222"
        },
        {
          "url": "https://git.kernel.org/stable/c/9739d5830497812b0bdeaee356ddefbe60830b88"
        }
      ],
      "title": "i40e: fix input validation logic for action_meta",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-39970",
    "datePublished": "2025-10-15T07:55:53.610Z",
    "dateReserved": "2025-04-16T07:20:57.149Z",
    "dateUpdated": "2026-08-05T12:06:39.532Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-39970",
      "date": "2026-08-15",
      "epss": "0.00144",
      "percentile": "0.04187"
    },
    "microsoft_vex": {
      "current_release_date": "2025-10-16T01:01:31.000Z",
      "cve": "CVE-2025-39970",
      "id": "msrc_CVE-2025-39970",
      "initial_release_date": "2025-10-02T00:00:00.000Z",
      "product_status:fixed": "1",
      "product_status:known_affected": "2",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "i40e: fix input validation logic for action_meta",
      "url": "https://msrc.microsoft.com/csaf/vex/2025/msrc_cve-2025-39970.json",
      "version": "1"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-39970\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-10-15T08:15:34.620\",\"lastModified\":\"2026-07-30T06:24:02.763\",\"vulnStatus\":\"Deferred\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\ni40e: fix input validation logic for action_meta\\n\\nFix condition to check \u0027greater or equal\u0027 to prevent OOB dereference.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"e284fc280473bed23f2e1ed324e102a48f7d17e1\",\"lessThan\":\"a88c1b2746eccf00e2094b187945f0f1e990b400\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"e284fc280473bed23f2e1ed324e102a48f7d17e1\",\"lessThan\":\"28465770ca3b694286ff9ed6dfd558413f57d98f\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"e284fc280473bed23f2e1ed324e102a48f7d17e1\",\"lessThan\":\"f8c8e11825b24661596fa8db2f0981ba17ed0817\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"e284fc280473bed23f2e1ed324e102a48f7d17e1\",\"lessThan\":\"461e0917eedcd159d87f3ea846754a1e07d7e78a\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"e284fc280473bed23f2e1ed324e102a48f7d17e1\",\"lessThan\":\"3883e9702b6a4945e93b16c070f338a9f5b496f9\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"e284fc280473bed23f2e1ed324e102a48f7d17e1\",\"lessThan\":\"3118f41d8fa57b005f53ec3db2ba5eab1d7ba12b\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"e284fc280473bed23f2e1ed324e102a48f7d17e1\",\"lessThan\":\"560e1683410585fbd5df847f43433c4296f0d222\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"e284fc280473bed23f2e1ed324e102a48f7d17e1\",\"lessThan\":\"9739d5830497812b0bdeaee356ddefbe60830b88\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"4.17\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"4.17\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.4.300\",\"lessThanOrEqual\":\"5.4.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.10.245\",\"lessThanOrEqual\":\"5.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.194\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.155\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.109\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.50\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.16.10\",\"lessThanOrEqual\":\"6.16.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.17\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H\",\"baseScore\":8.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"CHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":2.0,\"impactScore\":6.0}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/28465770ca3b694286ff9ed6dfd558413f57d98f\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/3118f41d8fa57b005f53ec3db2ba5eab1d7ba12b\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/3883e9702b6a4945e93b16c070f338a9f5b496f9\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/461e0917eedcd159d87f3ea846754a1e07d7e78a\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/560e1683410585fbd5df847f43433c4296f0d222\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/9739d5830497812b0bdeaee356ddefbe60830b88\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/a88c1b2746eccf00e2094b187945f0f1e990b400\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/f8c8e11825b24661596fa8db2f0981ba17ed0817\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-07-30T08:54:19+00:00",
      "cve": "CVE-2025-39970",
      "id": "CVE-2025-39970",
      "initial_release_date": "2025-10-15T00:00:00+00:00",
      "product_status:known_affected": "260",
      "product_status:known_not_affected": "14",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: i40e: fix input validation logic for action_meta",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-39970.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-07-19T17:47:23Z",
      "cve": "CVE-2025-39970",
      "id": "CVE-2025-39970",
      "initial_release_date": "2025-10-16T23:24:44Z",
      "product_status:first_fixed": "2",
      "product_status:known_affected": "585",
      "product_status:known_not_affected": "52",
      "product_status:recommended": "523",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2025-39970",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2025-39970.json",
      "version": "44"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.