CVE-2025-39971 (GCVE-0-2025-39971)

Vulnerability from cvelistv5 – Published: 2025-10-15 07:55 – Updated: 2026-08-05 12:06
VLAI
Title
i40e: fix idx validation in config queues msg
Summary
In the Linux kernel, the following vulnerability has been resolved: i40e: fix idx validation in config queues msg Ensure idx is within range of active/initialized TCs when iterating over vf->ch[idx] in i40e_vc_config_queues_msg().
Severity
8.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-06-16 15:52 UTC
Assigner
Linux CNA under the mitre root
CNA scorecard D 54/100 over 6618 records in the last 180 days details
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: c27eac48160de72dee33d42b5a33cc7b8a2eb1f5 , < a6ff2af78343eceb0f77ab1a2fe802183bc21648 (git)
Affected: c27eac48160de72dee33d42b5a33cc7b8a2eb1f5 , < f5f91d164af22e7147130ef8bebbdb28d8ecc6e2 (git)
Affected: c27eac48160de72dee33d42b5a33cc7b8a2eb1f5 , < 1fa0aadade34481c567cdf4a897c0d4e4d548bd1 (git)
Affected: c27eac48160de72dee33d42b5a33cc7b8a2eb1f5 , < 8b9c7719b0987b1c6c5fc910599f3618a558dbde (git)
Affected: c27eac48160de72dee33d42b5a33cc7b8a2eb1f5 , < 2cc26dac0518d2fa9b67ec813ee60e183480f98a (git)
Affected: c27eac48160de72dee33d42b5a33cc7b8a2eb1f5 , < bfcc1dff429d4b99ba03e40ddacc68ea4be2b32b (git)
Affected: c27eac48160de72dee33d42b5a33cc7b8a2eb1f5 , < 5c1f96123113e0bdc6d8dc2b0830184c93da9f65 (git)
Affected: c27eac48160de72dee33d42b5a33cc7b8a2eb1f5 , < f1ad24c5abe1eaef69158bac1405a74b3c365115 (git)
guessed Create a notification for this product.
Linux Linux Affected: 4.17
Unaffected: 0 , < 4.17 (semver)
Unaffected: 5.4.300 , ≤ 5.4.* (semver)
Unaffected: 5.10.245 , ≤ 5.10.* (semver)
Unaffected: 5.15.194 , ≤ 5.15.* (semver)
Unaffected: 6.1.155 , ≤ 6.1.* (semver)
Unaffected: 6.6.109 , ≤ 6.6.* (semver)
Unaffected: 6.12.50 , ≤ 6.12.* (semver)
Unaffected: 6.16.10 , ≤ 6.16.* (semver)
Unaffected: 6.17 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-39971",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-16T15:52:18.829458Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-16T15:52:31.898Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "a6ff2af78343eceb0f77ab1a2fe802183bc21648",
              "status": "affected",
              "version": "c27eac48160de72dee33d42b5a33cc7b8a2eb1f5",
              "versionType": "git"
            },
            {
              "lessThan": "f5f91d164af22e7147130ef8bebbdb28d8ecc6e2",
              "status": "affected",
              "version": "c27eac48160de72dee33d42b5a33cc7b8a2eb1f5",
              "versionType": "git"
            },
            {
              "lessThan": "1fa0aadade34481c567cdf4a897c0d4e4d548bd1",
              "status": "affected",
              "version": "c27eac48160de72dee33d42b5a33cc7b8a2eb1f5",
              "versionType": "git"
            },
            {
              "lessThan": "8b9c7719b0987b1c6c5fc910599f3618a558dbde",
              "status": "affected",
              "version": "c27eac48160de72dee33d42b5a33cc7b8a2eb1f5",
              "versionType": "git"
            },
            {
              "lessThan": "2cc26dac0518d2fa9b67ec813ee60e183480f98a",
              "status": "affected",
              "version": "c27eac48160de72dee33d42b5a33cc7b8a2eb1f5",
              "versionType": "git"
            },
            {
              "lessThan": "bfcc1dff429d4b99ba03e40ddacc68ea4be2b32b",
              "status": "affected",
              "version": "c27eac48160de72dee33d42b5a33cc7b8a2eb1f5",
              "versionType": "git"
            },
            {
              "lessThan": "5c1f96123113e0bdc6d8dc2b0830184c93da9f65",
              "status": "affected",
              "version": "c27eac48160de72dee33d42b5a33cc7b8a2eb1f5",
              "versionType": "git"
            },
            {
              "lessThan": "f1ad24c5abe1eaef69158bac1405a74b3c365115",
              "status": "affected",
              "version": "c27eac48160de72dee33d42b5a33cc7b8a2eb1f5",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.17"
            },
            {
              "lessThan": "4.17",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.300",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.245",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.194",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.155",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.109",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.50",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.16.*",
              "status": "unaffected",
              "version": "6.16.10",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.17",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.300",
                  "versionStartIncluding": "4.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.245",
                  "versionStartIncluding": "4.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.194",
                  "versionStartIncluding": "4.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.155",
                  "versionStartIncluding": "4.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.109",
                  "versionStartIncluding": "4.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.50",
                  "versionStartIncluding": "4.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.16.10",
                  "versionStartIncluding": "4.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.17",
                  "versionStartIncluding": "4.17",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ni40e: fix idx validation in config queues msg\n\nEnsure idx is within range of active/initialized TCs when iterating over\nvf-\u003ech[idx] in i40e_vc_config_queues_msg()."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The malicious input arrives as a `VIRTCHNL_OP_CONFIG_VSI_QUEUES` message on the SR-IOV VF\u2192PF admin-queue mailbox, a PCIe transport, not a network protocol. The attacker needs local control of an assigned VF (guest VM or VF-owning container), so this is local reachability rather than network or adjacent.\nAC:L - The attacker fully controls every input \u2014 `num_tc` and per-TC `count` via ENABLE_CHANNELS, then `num_queue_pairs` and the qpair array via CONFIG_VSI_QUEUES \u2014 so shrinking `num_tc` to leave stale `ch[]` entries and then walking `idx` into them is deterministic on the first attempt with no memory grooming or race. The only precondition, spoofchk disabled, is inherent to any ADq-enabled SR-IOV deployment and is a standard runtime configuration.\nPR:L - The attacker only needs to drive the VF\u0027s admin queue \u2014 kernel/root inside the assigned guest, or possession of the VFIO device \u2014 which is a low-privileged position relative to the host PF driver under attack. No privileges of any kind on the host are required.\nUI:N - The malicious VF sends the virtchnl message sequence entirely on its own initiative. No host administrator or other user action is needed at any stage.\nS:C - The attacking VF sits in a guest VM (or VF-assigned container) while the stale-index read and the resulting hardware queue-context programming occur in the host PF driver\u0027s security authority. The corrupted resources \u2014 HMC LAN Tx/Rx contexts and QTX_CTL bindings of VSIs belonging to the PF or to other VFs \u2014 are outside the attacker\u0027s scope, crossing the guest/host and inter-tenant SR-IOV boundary.\nC:H - Using a stale `ch[idx].vsi_id`, the VF resolves and reprograms the Rx queue context of a VSI it does not own, setting `rx_ctx.base` from its own `dma_ring_addr` so another VSI\u0027s received traffic is DMA\u0027d into attacker-designated memory \u2014 interception of host and cross-guest traffic. On pre-5.2 kernels the same defect additionally reads past the end of `vf-\u003ech[]` into adjacent `struct i40e_vf` state.\nI:H - `i40e_config_vsi_rx_queue()` performs no ownership check and `i40e_config_vsi_tx_queue()` validates only the VF-supplied `info-\u003evsi_id`, so the stale ID lets the VF clear and rewrite the LAN HMC Tx/Rx contexts of a foreign VSI\u0027s queues and issue a `QTX_CTL` write rebinding that PF queue to itself. This is attacker-controlled modification of host- and peer-owned hardware state.\nA:H - Clearing and rewriting queue contexts belonging to the PF\u0027s main VSI or another guest\u0027s VSI stalls or wedges those queues, and out-of-range `pf_queue_id` values (`I40E_QUEUE_END_OF_LIST`) drive HMC operations that trigger adapter error paths, PF/VF reset storms and loss of host networking. The VF can repeat the sequence at will, and a downed host PF takes every guest on the adapter with it."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:06:40.599Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/a6ff2af78343eceb0f77ab1a2fe802183bc21648"
        },
        {
          "url": "https://git.kernel.org/stable/c/f5f91d164af22e7147130ef8bebbdb28d8ecc6e2"
        },
        {
          "url": "https://git.kernel.org/stable/c/1fa0aadade34481c567cdf4a897c0d4e4d548bd1"
        },
        {
          "url": "https://git.kernel.org/stable/c/8b9c7719b0987b1c6c5fc910599f3618a558dbde"
        },
        {
          "url": "https://git.kernel.org/stable/c/2cc26dac0518d2fa9b67ec813ee60e183480f98a"
        },
        {
          "url": "https://git.kernel.org/stable/c/bfcc1dff429d4b99ba03e40ddacc68ea4be2b32b"
        },
        {
          "url": "https://git.kernel.org/stable/c/5c1f96123113e0bdc6d8dc2b0830184c93da9f65"
        },
        {
          "url": "https://git.kernel.org/stable/c/f1ad24c5abe1eaef69158bac1405a74b3c365115"
        }
      ],
      "title": "i40e: fix idx validation in config queues msg",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-39971",
    "datePublished": "2025-10-15T07:55:54.270Z",
    "dateReserved": "2025-04-16T07:20:57.149Z",
    "dateUpdated": "2026-08-05T12:06:40.599Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-39971",
      "date": "2026-10-11",
      "epss": "0.00154",
      "percentile": "0.04058"
    },
    "microsoft_vex": {
      "current_release_date": "2025-10-16T01:01:48.000Z",
      "cve": "CVE-2025-39971",
      "id": "msrc_CVE-2025-39971",
      "initial_release_date": "2025-10-02T00:00:00.000Z",
      "product_status:fixed": "1",
      "product_status:known_affected": "2",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "i40e: fix idx validation in config queues msg",
      "url": "https://msrc.microsoft.com/csaf/vex/2025/msrc_cve-2025-39971.json",
      "version": "1"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "a6ff2af78343eceb0f77ab1a2fe802183bc21648",
                    "status": "affected",
                    "version": "c27eac48160de72dee33d42b5a33cc7b8a2eb1f5",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "f5f91d164af22e7147130ef8bebbdb28d8ecc6e2",
                    "status": "affected",
                    "version": "c27eac48160de72dee33d42b5a33cc7b8a2eb1f5",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "1fa0aadade34481c567cdf4a897c0d4e4d548bd1",
                    "status": "affected",
                    "version": "c27eac48160de72dee33d42b5a33cc7b8a2eb1f5",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "8b9c7719b0987b1c6c5fc910599f3618a558dbde",
                    "status": "affected",
                    "version": "c27eac48160de72dee33d42b5a33cc7b8a2eb1f5",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "2cc26dac0518d2fa9b67ec813ee60e183480f98a",
                    "status": "affected",
                    "version": "c27eac48160de72dee33d42b5a33cc7b8a2eb1f5",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "bfcc1dff429d4b99ba03e40ddacc68ea4be2b32b",
                    "status": "affected",
                    "version": "c27eac48160de72dee33d42b5a33cc7b8a2eb1f5",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "5c1f96123113e0bdc6d8dc2b0830184c93da9f65",
                    "status": "affected",
                    "version": "c27eac48160de72dee33d42b5a33cc7b8a2eb1f5",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "f1ad24c5abe1eaef69158bac1405a74b3c365115",
                    "status": "affected",
                    "version": "c27eac48160de72dee33d42b5a33cc7b8a2eb1f5",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "4.17"
                  },
                  {
                    "lessThan": "4.17",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.4.*",
                    "status": "unaffected",
                    "version": "5.4.300",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.10.*",
                    "status": "unaffected",
                    "version": "5.10.245",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.15.*",
                    "status": "unaffected",
                    "version": "5.15.194",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.1.*",
                    "status": "unaffected",
                    "version": "6.1.155",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.6.*",
                    "status": "unaffected",
                    "version": "6.6.109",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.50",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.16.*",
                    "status": "unaffected",
                    "version": "6.16.10",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "6.17",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ni40e: fix idx validation in config queues msg\n\nEnsure idx is within range of active/initialized TCs when iterating over\nvf-\u003ech[idx] in i40e_vc_config_queues_msg()."
          }
        ],
        "id": "CVE-2025-39971",
        "lastModified": "2026-07-30T06:24:02.880",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 8.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "CHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 2.0,
              "impactScore": 6.0,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2025-39971",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-16T15:52:18.829458Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2025-10-15T08:15:34.757",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/1fa0aadade34481c567cdf4a897c0d4e4d548bd1"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/2cc26dac0518d2fa9b67ec813ee60e183480f98a"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/5c1f96123113e0bdc6d8dc2b0830184c93da9f65"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/8b9c7719b0987b1c6c5fc910599f3618a558dbde"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/a6ff2af78343eceb0f77ab1a2fe802183bc21648"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/bfcc1dff429d4b99ba03e40ddacc68ea4be2b32b"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/f1ad24c5abe1eaef69158bac1405a74b3c365115"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/f5f91d164af22e7147130ef8bebbdb28d8ecc6e2"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Deferred"
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-07-30T08:57:08+00:00",
      "cve": "CVE-2025-39971",
      "id": "CVE-2025-39971",
      "initial_release_date": "2025-10-15T00:00:00+00:00",
      "product_status:fixed": "2416",
      "product_status:known_affected": "22",
      "product_status:known_not_affected": "14",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: i40e: fix idx validation in config queues msg",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-39971.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-10-10T16:33:24Z",
      "cve": "CVE-2025-39971",
      "id": "CVE-2025-39971",
      "initial_release_date": "2025-10-16T23:24:42Z",
      "product_status:known_affected": "637",
      "product_status:known_not_affected": "96",
      "product_status:recommended": "632",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2025-39971",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2025-39971.json",
      "version": "59"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2025-39971",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-06-16T15:52:18.829458Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-06-16T15:52:24.239Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "product": "Linux",
              "programFiles": [
                "drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c"
              ],
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "vendor": "Linux",
              "versions": [
                {
                  "lessThan": "a6ff2af78343eceb0f77ab1a2fe802183bc21648",
                  "status": "affected",
                  "version": "c27eac48160de72dee33d42b5a33cc7b8a2eb1f5",
                  "versionType": "git"
                },
                {
                  "lessThan": "f5f91d164af22e7147130ef8bebbdb28d8ecc6e2",
                  "status": "affected",
                  "version": "c27eac48160de72dee33d42b5a33cc7b8a2eb1f5",
                  "versionType": "git"
                },
                {
                  "lessThan": "1fa0aadade34481c567cdf4a897c0d4e4d548bd1",
                  "status": "affected",
                  "version": "c27eac48160de72dee33d42b5a33cc7b8a2eb1f5",
                  "versionType": "git"
                },
                {
                  "lessThan": "8b9c7719b0987b1c6c5fc910599f3618a558dbde",
                  "status": "affected",
                  "version": "c27eac48160de72dee33d42b5a33cc7b8a2eb1f5",
                  "versionType": "git"
                },
                {
                  "lessThan": "2cc26dac0518d2fa9b67ec813ee60e183480f98a",
                  "status": "affected",
                  "version": "c27eac48160de72dee33d42b5a33cc7b8a2eb1f5",
                  "versionType": "git"
                },
                {
                  "lessThan": "bfcc1dff429d4b99ba03e40ddacc68ea4be2b32b",
                  "status": "affected",
                  "version": "c27eac48160de72dee33d42b5a33cc7b8a2eb1f5",
                  "versionType": "git"
                },
                {
                  "lessThan": "5c1f96123113e0bdc6d8dc2b0830184c93da9f65",
                  "status": "affected",
                  "version": "c27eac48160de72dee33d42b5a33cc7b8a2eb1f5",
                  "versionType": "git"
                },
                {
                  "lessThan": "f1ad24c5abe1eaef69158bac1405a74b3c365115",
                  "status": "affected",
                  "version": "c27eac48160de72dee33d42b5a33cc7b8a2eb1f5",
                  "versionType": "git"
                }
              ]
            },
            {
              "defaultStatus": "affected",
              "product": "Linux",
              "programFiles": [
                "drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c"
              ],
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "vendor": "Linux",
              "versions": [
                {
                  "status": "affected",
                  "version": "4.17"
                },
                {
                  "lessThan": "4.17",
                  "status": "unaffected",
                  "version": "0",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "5.4.*",
                  "status": "unaffected",
                  "version": "5.4.300",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "5.10.*",
                  "status": "unaffected",
                  "version": "5.10.245",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "5.15.*",
                  "status": "unaffected",
                  "version": "5.15.194",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "6.1.*",
                  "status": "unaffected",
                  "version": "6.1.155",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "6.6.*",
                  "status": "unaffected",
                  "version": "6.6.109",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "6.12.*",
                  "status": "unaffected",
                  "version": "6.12.50",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "6.16.*",
                  "status": "unaffected",
                  "version": "6.16.10",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "*",
                  "status": "unaffected",
                  "version": "6.17",
                  "versionType": "original_commit_for_fix"
                }
              ]
            }
          ],
          "cpeApplicability": [
            {
              "nodes": [
                {
                  "cpeMatch": [
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "5.4.300",
                      "versionStartIncluding": "4.17",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "5.10.245",
                      "versionStartIncluding": "4.17",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "5.15.194",
                      "versionStartIncluding": "4.17",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "6.1.155",
                      "versionStartIncluding": "4.17",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "6.6.109",
                      "versionStartIncluding": "4.17",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "6.12.50",
                      "versionStartIncluding": "4.17",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "6.16.10",
                      "versionStartIncluding": "4.17",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "6.17",
                      "versionStartIncluding": "4.17",
                      "vulnerable": true
                    }
                  ],
                  "negate": false,
                  "operator": "OR"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ni40e: fix idx validation in config queues msg\n\nEnsure idx is within range of active/initialized TCs when iterating over\nvf-\u003ech[idx] in i40e_vc_config_queues_msg()."
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "baseScore": 8.8,
                "baseSeverity": "HIGH",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
                "version": "3.1"
              },
              "scenarios": [
                {
                  "lang": "en",
                  "value": "AV:L - The malicious input arrives as a `VIRTCHNL_OP_CONFIG_VSI_QUEUES` message on the SR-IOV VF\u2192PF admin-queue mailbox, a PCIe transport, not a network protocol. The attacker needs local control of an assigned VF (guest VM or VF-owning container), so this is local reachability rather than network or adjacent.\nAC:L - The attacker fully controls every input \u2014 `num_tc` and per-TC `count` via ENABLE_CHANNELS, then `num_queue_pairs` and the qpair array via CONFIG_VSI_QUEUES \u2014 so shrinking `num_tc` to leave stale `ch[]` entries and then walking `idx` into them is deterministic on the first attempt with no memory grooming or race. The only precondition, spoofchk disabled, is inherent to any ADq-enabled SR-IOV deployment and is a standard runtime configuration.\nPR:L - The attacker only needs to drive the VF\u0027s admin queue \u2014 kernel/root inside the assigned guest, or possession of the VFIO device \u2014 which is a low-privileged position relative to the host PF driver under attack. No privileges of any kind on the host are required.\nUI:N - The malicious VF sends the virtchnl message sequence entirely on its own initiative. No host administrator or other user action is needed at any stage.\nS:C - The attacking VF sits in a guest VM (or VF-assigned container) while the stale-index read and the resulting hardware queue-context programming occur in the host PF driver\u0027s security authority. The corrupted resources \u2014 HMC LAN Tx/Rx contexts and QTX_CTL bindings of VSIs belonging to the PF or to other VFs \u2014 are outside the attacker\u0027s scope, crossing the guest/host and inter-tenant SR-IOV boundary.\nC:H - Using a stale `ch[idx].vsi_id`, the VF resolves and reprograms the Rx queue context of a VSI it does not own, setting `rx_ctx.base` from its own `dma_ring_addr` so another VSI\u0027s received traffic is DMA\u0027d into attacker-designated memory \u2014 interception of host and cross-guest traffic. On pre-5.2 kernels the same defect additionally reads past the end of `vf-\u003ech[]` into adjacent `struct i40e_vf` state.\nI:H - `i40e_config_vsi_rx_queue()` performs no ownership check and `i40e_config_vsi_tx_queue()` validates only the VF-supplied `info-\u003evsi_id`, so the stale ID lets the VF clear and rewrite the LAN HMC Tx/Rx contexts of a foreign VSI\u0027s queues and issue a `QTX_CTL` write rebinding that PF queue to itself. This is attacker-controlled modification of host- and peer-owned hardware state.\nA:H - Clearing and rewriting queue contexts belonging to the PF\u0027s main VSI or another guest\u0027s VSI stalls or wedges those queues, and out-of-range `pf_queue_id` values (`I40E_QUEUE_END_OF_LIST`) drive HMC operations that trigger adapter error paths, PF/VF reset storms and loss of host networking. The VF can repeat the sequence at will, and a downed host PF takes every guest on the adapter with it."
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-08-05T12:06:40.599Z",
            "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "shortName": "Linux"
          },
          "references": [
            {
              "url": "https://git.kernel.org/stable/c/a6ff2af78343eceb0f77ab1a2fe802183bc21648"
            },
            {
              "url": "https://git.kernel.org/stable/c/f5f91d164af22e7147130ef8bebbdb28d8ecc6e2"
            },
            {
              "url": "https://git.kernel.org/stable/c/1fa0aadade34481c567cdf4a897c0d4e4d548bd1"
            },
            {
              "url": "https://git.kernel.org/stable/c/8b9c7719b0987b1c6c5fc910599f3618a558dbde"
            },
            {
              "url": "https://git.kernel.org/stable/c/2cc26dac0518d2fa9b67ec813ee60e183480f98a"
            },
            {
              "url": "https://git.kernel.org/stable/c/bfcc1dff429d4b99ba03e40ddacc68ea4be2b32b"
            },
            {
              "url": "https://git.kernel.org/stable/c/5c1f96123113e0bdc6d8dc2b0830184c93da9f65"
            },
            {
              "url": "https://git.kernel.org/stable/c/f1ad24c5abe1eaef69158bac1405a74b3c365115"
            }
          ],
          "title": "i40e: fix idx validation in config queues msg",
          "x_generator": {
            "engine": "bippy-1.2.0"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "assignerShortName": "Linux",
        "cveId": "CVE-2025-39971",
        "datePublished": "2025-10-15T07:55:54.270Z",
        "dateReserved": "2025-04-16T07:20:57.149Z",
        "dateUpdated": "2026-08-05T12:06:40.599Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.