CVE-2025-40104

{
  "id": "CVE-2025-40104",
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
  "published": "2025-10-30T10:15:34.783",
  "lastModified": "2026-10-19T21:10:00.160",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nixgbevf: fix mailbox API compatibility by negotiating supported features\n\nThere was backward compatibility in the terms of mailbox API. Various\ndrivers from various OSes supporting 10G adapters from Intel portfolio\ncould easily negotiate mailbox API.\n\nThis convention has been broken since introducing API 1.4.\nCommit 0062e7cc955e (\"ixgbevf: add VF IPsec offload code\") added support\nfor IPSec which is specific only for the kernel ixgbe driver. None of the\nrest of the Intel 10G PF/VF drivers supports it. And actually lack of\nsupport was not included in the IPSec implementation - there were no such\ncode paths. No possibility to negotiate support for the feature was\nintroduced along with introduction of the feature itself.\n\nCommit 339f28964147 (\"ixgbevf: Add support for new mailbox communication\nbetween PF and VF\") increasing API version to 1.5 did the same - it\nintroduced code supported specifically by the PF ESX driver. It altered API\nversion for the VF driver in the same time not touching the version\ndefined for the PF ixgbe driver. It led to additional discrepancies,\nas the code provided within API 1.6 cannot be supported for Linux ixgbe\ndriver as it causes crashes.\n\nThe issue was noticed some time ago and mitigated by Jake within the commit\nd0725312adf5 (\"ixgbevf: stop attempting IPSEC offload on Mailbox API 1.5\").\nAs a result we have regression for IPsec support and after increasing API\nto version 1.6 ixgbevf driver stopped to support ESX MBX.\n\nTo fix this mess add new mailbox op asking PF driver about supported\nfeatures. Basing on a response determine whether to set support for IPSec\nand ESX-specific enhanced mailbox.\n\nNew mailbox op, for compatibility purposes, must be added within new API\nrevision, as API version of OOT PF & VF drivers is already increased to\n1.6 and doesn't incorporate features negotiate op.\n\nFeatures negotiation mechanism gives possibility to be extended with new\nfeatures when needed in the future."
    },
    {
      "lang": "es",
      "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nixgbevf: corrige la compatibilidad de la API del buzón negociando las características soportadas\n\nHabía compatibilidad hacia atrás en términos de la API del buzón. Varios controladores de varios sistemas operativos que soportaban adaptadores de 10G de la cartera de Intel podían negociar fácilmente la API del buzón.\n\nEsta convención se ha roto desde la introducción de la API 1.4. El commit 0062e7cc955e (“ixgbevf: add VF IPsec offload code”) añadió soporte para IPSec, que es específico solo para el controlador ixgbe del kernel. Ninguno del resto de los controladores PF/VF de 10G de Intel lo soporta. Y, de hecho, la falta de soporte no se incluyó en la implementación de IPSec; no existían tales rutas de código. No se introdujo ninguna posibilidad de negociar el soporte para la característica junto con la introducción de la característica misma.\n\nEl commit 339f28964147 (“ixgbevf: Add support for new mailbox communication between PF and VF”), que aumentó la versión de la API a 1.5, hizo lo mismo: introdujo código soportado específicamente por el controlador PF ESX. Alteró la versión de la API para el controlador VF al mismo tiempo que no tocó la versión definida para el controlador PF ixgbe. Esto llevó a discrepancias adicionales, ya que el código proporcionado dentro de la API 1.6 no puede ser soportado para el controlador ixgbe de Linux, ya que causa fallos.\n\nEl problema fue notado hace algún tiempo y mitigado por Jake dentro del commit d0725312adf5 (“ixgbevf: stop attempting IPSEC offload on Mailbox API 1.5”). Como resultado, tenemos una regresión para el soporte de IPsec y, después de aumentar la API a la versión 1.6, el controlador ixgbevf dejó de soportar ESX MBX.\n\nPara arreglar este lío, se añade una nueva operación de buzón que pregunta al controlador PF sobre las características soportadas. Basándose en una respuesta, se determina si establecer el soporte para IPSec y el buzón mejorado específico de ESX.\n\nLa nueva operación de buzón, para propósitos de compatibilidad, debe ser añadida dentro de una nueva revisión de la API, ya que la versión de la API de los controladores OOT PF y VF ya ha sido aumentada a 1.6 y no incorpora la operación de negociación de características.\n\nEl mecanismo de negociación de características da la posibilidad de ser extendido con nuevas características cuando sea necesario en el futuro."
    }
  ],
  "affected": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "affectedData": [
        {
          "vendor": "Linux",
          "product": "Linux",
          "defaultStatus": "unaffected",
          "programFiles": [
            "drivers/net/ethernet/intel/ixgbevf/ipsec.c",
            "drivers/net/ethernet/intel/ixgbevf/ixgbevf.h",
            "drivers/net/ethernet/intel/ixgbevf/ixgbevf_main.c",
            "drivers/net/ethernet/intel/ixgbevf/mbx.h",
            "drivers/net/ethernet/intel/ixgbevf/vf.c",
            "drivers/net/ethernet/intel/ixgbevf/vf.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "versions": [
            {
              "version": "0062e7cc955e0827a88570ed36ea511a7dcb391e",
              "lessThan": "871ac1cd4ce4804defcb428cbb003fd84c415ff4",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "0062e7cc955e0827a88570ed36ea511a7dcb391e",
              "lessThan": "2e0aab9ddaf1428602c78f12064cd1e6ffcc4d18",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "0062e7cc955e0827a88570ed36ea511a7dcb391e",
              "lessThan": "bf580112ed61736c2645a893413a04732505d4b1",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "0062e7cc955e0827a88570ed36ea511a7dcb391e",
              "lessThan": "a376e29b1b196dc90b50df7e5e3947e3026300c4",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "0062e7cc955e0827a88570ed36ea511a7dcb391e",
              "lessThan": "a7075f501bd33c93570af759b6f4302ef0175168",
              "versionType": "git",
              "status": "affected"
            }
          ]
        },
        {
          "vendor": "Linux",
          "product": "Linux",
          "defaultStatus": "affected",
          "programFiles": [
            "drivers/net/ethernet/intel/ixgbevf/ipsec.c",
            "drivers/net/ethernet/intel/ixgbevf/ixgbevf.h",
            "drivers/net/ethernet/intel/ixgbevf/ixgbevf_main.c",
            "drivers/net/ethernet/intel/ixgbevf/mbx.h",
            "drivers/net/ethernet/intel/ixgbevf/vf.c",
            "drivers/net/ethernet/intel/ixgbevf/vf.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "versions": [
            {
              "version": "4.20",
              "status": "affected"
            },
            {
              "version": "0",
              "lessThan": "4.20",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "6.1.158",
              "lessThanOrEqual": "6.1.*",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "6.6.114",
              "lessThanOrEqual": "6.6.*",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "6.12.55",
              "lessThanOrEqual": "6.12.*",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "6.17.5",
              "lessThanOrEqual": "6.17.*",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "6.18",
              "lessThanOrEqual": "*",
              "versionType": "original_commit_for_fix",
              "status": "unaffected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "baseScore": 7.8,
          "baseSeverity": "HIGH",
          "attackVector": "LOCAL",
          "attackComplexity": "LOW",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 1.8,
        "impactScore": 5.9
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-10-15T21:56:54.238520Z",
          "id": "CVE-2025-40104",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "references": [
    {
      "url": "https://git.kernel.org/stable/c/2e0aab9ddaf1428602c78f12064cd1e6ffcc4d18",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/871ac1cd4ce4804defcb428cbb003fd84c415ff4",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/a376e29b1b196dc90b50df7e5e3947e3026300c4",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/a7075f501bd33c93570af759b6f4302ef0175168",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/bf580112ed61736c2645a893413a04732505d4b1",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ]
}