« Back to list

CVE-2025-39973

Status: DeferredHigh (8.8)—

In the Linux kernel, the following vulnerability has been resolved:

i40e: add validation for ring_len param

The `ring_len` parameter provided by the virtual function (VF) is assigned directly to the hardware memory context (HMC) without any validation.

To address this, introduce an upper boundary check for both Tx and Rx queue lengths. The maximum number of descriptors supported by the hardware is 8k-32. Additionally, enforce alignment constraints: Tx rings must be a multiple of 8, and Rx rings must be a multiple of 32.

CVSS

Exploitation probability (EPSS)

EPSS (Exploit Prediction Scoring System, FIRST) estimates how likely a vulnerability is to be exploited in the wild within 30 days. It complements CVSS (impact) and CISA KEV (confirmed exploitation).

🎯 ATT&CK techniques

How this vulnerability is exploited and what the attacker gains, in MITRE ATT&CK terms.

Vulnerabilidad local sin validación de parámetros en controlador i40e del kernel Linux (AV:L/PR:L) que permite escalada de privilegios. La asignación sin validación a contexto HMC y falta de restricciones de alineación permiten ejecución de código e interrupción del servicio.

Inferred by our analysis agent from the official description, CVSS vector and CWE, and checked by a supervisor. May contain errors.

🛡️ ATT&CK mitigations that cover these techniques

Execution PreventionThreat Intelligence ProgramRestrict Web-Based ContentPrivileged Account ManagementLimit Software InstallationFilter Network Traffic

Affected technologies (1)

⚠ AI-inferred from the description — NVD hasn't analyzed this CVE yet, these aren't verified CPEs.

Linux — Linux KernelAI

References

Raw JSON (NVD)

Show
{
  "id": "CVE-2025-39973",
  "cveTags": [],
  "metrics": {
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 8.8,
          "attackVector": "LOCAL",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 6,
        "exploitabilityScore": 2
      }
    ]
  },
  "affected": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "affectedData": [
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5c3c48ac6bf56367c4e89f6453cd2d61e50375bd",
              "lessThan": "0543d40d6513cdf1c7882811086e59a6455dfe97",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "5c3c48ac6bf56367c4e89f6453cd2d61e50375bd",
              "lessThan": "7d749e38dd2b7e8a80da2ca30c93e09de95bfcf9",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "5c3c48ac6bf56367c4e89f6453cd2d61e50375bd",
              "lessThan": "45a7527cd7da4cdcf3b06b5c0cb1cae30b5a5985",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "5c3c48ac6bf56367c4e89f6453cd2d61e50375bd",
              "lessThan": "d3b0d3f8d11fa957171fbb186e53998361a88d4e",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "5c3c48ac6bf56367c4e89f6453cd2d61e50375bd",
              "lessThan": "c0c83f4cd074b75cecef107bfc349be7d516c9c4",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "5c3c48ac6bf56367c4e89f6453cd2d61e50375bd",
              "lessThan": "05fe81fb9db20464fa532a3835dc8300d68a2f84",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "5c3c48ac6bf56367c4e89f6453cd2d61e50375bd",
              "lessThan": "afec12adab55d10708179a64d95d650741e60fe0",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "5c3c48ac6bf56367c4e89f6453cd2d61e50375bd",
              "lessThan": "55d225670def06b01af2e7a5e0446fbe946289e8",
              "versionType": "git"
            }
          ],
          "programFiles": [
            "drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c"
          ],
          "defaultStatus": "unaffected"
        },
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.12"
            },
            {
              "status": "unaffected",
              "version": "0",
              "lessThan": "3.12",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "5.4.300",
              "versionType": "semver",
              "lessThanOrEqual": "5.4.*"
            },
            {
              "status": "unaffected",
              "version": "5.10.245",
              "versionType": "semver",
              "lessThanOrEqual": "5.10.*"
            },
            {
              "status": "unaffected",
              "version": "5.15.194",
              "versionType": "semver",
              "lessThanOrEqual": "5.15.*"
            },
            {
              "status": "unaffected",
              "version": "6.1.155",
              "versionType": "semver",
              "lessThanOrEqual": "6.1.*"
            },
            {
              "status": "unaffected",
              "version": "6.6.109",
              "versionType": "semver",
              "lessThanOrEqual": "6.6.*"
            },
            {
              "status": "unaffected",
              "version": "6.12.50",
              "versionType": "semver",
              "lessThanOrEqual": "6.12.*"
            },
            {
              "status": "unaffected",
              "version": "6.16.10",
              "versionType": "semver",
              "lessThanOrEqual": "6.16.*"
            },
            {
              "status": "unaffected",
              "version": "6.17",
              "versionType": "original_commit_for_fix",
              "lessThanOrEqual": "*"
            }
          ],
          "programFiles": [
            "drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c"
          ],
          "defaultStatus": "affected"
        }
      ]
    }
  ],
  "published": "2025-10-15T08:15:35.007",
  "references": [
    {
      "url": "https://git.kernel.org/stable/c/0543d40d6513cdf1c7882811086e59a6455dfe97",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/05fe81fb9db20464fa532a3835dc8300d68a2f84",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/45a7527cd7da4cdcf3b06b5c0cb1cae30b5a5985",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/55d225670def06b01af2e7a5e0446fbe946289e8",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/7d749e38dd2b7e8a80da2ca30c93e09de95bfcf9",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/afec12adab55d10708179a64d95d650741e60fe0",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/c0c83f4cd074b75cecef107bfc349be7d516c9c4",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/d3b0d3f8d11fa957171fbb186e53998361a88d4e",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "vulnStatus": "Deferred",
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ni40e: add validation for ring_len param\n\nThe `ring_len` parameter provided by the virtual function (VF)\nis assigned directly to the hardware memory context (HMC) without\nany validation.\n\nTo address this, introduce an upper boundary check for both Tx and Rx\nqueue lengths. The maximum number of descriptors supported by the\nhardware is 8k-32.\nAdditionally, enforce alignment constraints: Tx rings must be a multiple\nof 8, and Rx rings must be a multiple of 32."
    }
  ],
  "lastModified": "2026-07-30T06:24:03.340",
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}