CVE-2025-39973
Full vulnerability record from the local CVENow database.
Description
In the Linux kernel, the following vulnerability has been resolved: i40e: add validation for ring_len param The `ring_len` parameter provided by the virtual function (VF) is assigned directly to the hardware memory context (HMC) without any validation. To address this, introduce an upper boundary check for both Tx and Rx queue lengths. The maximum number of descriptors supported by the hardware is 8k-32. Additionally, enforce alignment constraints: Tx rings must be a multiple of 8, and Rx rings must be a multiple of 32.
Severity
HIGH
CVSS score
8.8
(v3.1)
Vulnerability status
Deferred
Source identifier
416baaa9-dc9f-4396-8d5f-8c081fb06d67
Published
2025-10-15 08:15:35.007000
Last modified
2026-10-19 21:10:00.160000
View original CVE JSON
{
"id": "CVE-2025-39973",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"published": "2025-10-15T08:15:35.007",
"lastModified": "2026-10-19T21:10:00.160",
"vulnStatus": "Deferred",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ni40e: add validation for ring_len param\n\nThe `ring_len` parameter provided by the virtual function (VF)\nis assigned directly to the hardware memory context (HMC) without\nany validation.\n\nTo address this, introduce an upper boundary check for both Tx and Rx\nqueue lengths. The maximum number of descriptors supported by the\nhardware is 8k-32.\nAdditionally, enforce alignment constraints: Tx rings must be a multiple\nof 8, and Rx rings must be a multiple of 32."
},
{
"lang": "es",
"value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\ni40e: añadir validación para el parámetro ring_len\n\nEl parámetro ring_len proporcionado por la función virtual (VF) se asigna directamente al contexto de memoria de hardware (HMC) sin ninguna validación.\n\nPara abordar esto, se introduce una comprobación de límite superior para las longitudes de cola tanto de Tx como de Rx. El número máximo de descriptores soportado por el hardware es 8k-32.\nAdemás, se aplican restricciones de alineación: los anillos Tx deben ser un múltiplo de 8, y los anillos Rx deben ser un múltiplo de 32."
}
],
"affected": [
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"affectedData": [
{
"vendor": "Linux",
"product": "Linux",
"defaultStatus": "unaffected",
"programFiles": [
"drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"versions": [
{
"version": "5c3c48ac6bf56367c4e89f6453cd2d61e50375bd",
"lessThan": "0543d40d6513cdf1c7882811086e59a6455dfe97",
"versionType": "git",
"status": "affected"
},
{
"version": "5c3c48ac6bf56367c4e89f6453cd2d61e50375bd",
"lessThan": "7d749e38dd2b7e8a80da2ca30c93e09de95bfcf9",
"versionType": "git",
"status": "affected"
},
{
"version": "5c3c48ac6bf56367c4e89f6453cd2d61e50375bd",
"lessThan": "45a7527cd7da4cdcf3b06b5c0cb1cae30b5a5985",
"versionType": "git",
"status": "affected"
},
{
"version": "5c3c48ac6bf56367c4e89f6453cd2d61e50375bd",
"lessThan": "d3b0d3f8d11fa957171fbb186e53998361a88d4e",
"versionType": "git",
"status": "affected"
},
{
"version": "5c3c48ac6bf56367c4e89f6453cd2d61e50375bd",
"lessThan": "c0c83f4cd074b75cecef107bfc349be7d516c9c4",
"versionType": "git",
"status": "affected"
},
{
"version": "5c3c48ac6bf56367c4e89f6453cd2d61e50375bd",
"lessThan": "05fe81fb9db20464fa532a3835dc8300d68a2f84",
"versionType": "git",
"status": "affected"
},
{
"version": "5c3c48ac6bf56367c4e89f6453cd2d61e50375bd",
"lessThan": "afec12adab55d10708179a64d95d650741e60fe0",
"versionType": "git",
"status": "affected"
},
{
"version": "5c3c48ac6bf56367c4e89f6453cd2d61e50375bd",
"lessThan": "55d225670def06b01af2e7a5e0446fbe946289e8",
"versionType": "git",
"status": "affected"
}
]
},
{
"vendor": "Linux",
"product": "Linux",
"defaultStatus": "affected",
"programFiles": [
"drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"versions": [
{
"version": "3.12",
"status": "affected"
},
{
"version": "0",
"lessThan": "3.12",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "5.4.300",
"lessThanOrEqual": "5.4.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "5.10.245",
"lessThanOrEqual": "5.10.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "5.15.194",
"lessThanOrEqual": "5.15.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "6.1.155",
"lessThanOrEqual": "6.1.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "6.6.109",
"lessThanOrEqual": "6.6.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "6.12.50",
"lessThanOrEqual": "6.12.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "6.16.10",
"lessThanOrEqual": "6.16.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "6.17",
"lessThanOrEqual": "*",
"versionType": "original_commit_for_fix",
"status": "unaffected"
}
]
}
]
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"attackVector": "LOCAL",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "CHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"availabilityImpact": "HIGH"
},
"exploitabilityScore": 2.0,
"impactScore": 6.0
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"timestamp": "2026-10-15T21:55:35.462344Z",
"id": "CVE-2025-39973",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "total"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
]
},
"references": [
{
"url": "https://git.kernel.org/stable/c/0543d40d6513cdf1c7882811086e59a6455dfe97",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/05fe81fb9db20464fa532a3835dc8300d68a2f84",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/45a7527cd7da4cdcf3b06b5c0cb1cae30b5a5985",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/55d225670def06b01af2e7a5e0446fbe946289e8",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/7d749e38dd2b7e8a80da2ca30c93e09de95bfcf9",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/afec12adab55d10708179a64d95d650741e60fe0",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/c0c83f4cd074b75cecef107bfc349be7d516c9c4",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/d3b0d3f8d11fa957171fbb186e53998361a88d4e",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
]
}