CVE-2025-39973

Katalog CVE

CVSS 8.8 · High EPSS 0,15%

Skor CVSS 3.1 8.8 (High) menurut CNA.

Deskripsi (NVD)

In the Linux kernel, the following vulnerability has been resolved: i40e: add validation for ring_len param The `ring_len` parameter provided by the virtual function (VF) is assigned directly to the hardware memory context (HMC) without any validation. To address this, introduce an upper boundary check for both Tx and Rx queue lengths. The maximum number of descriptors supported by the hardware is 8k-32. Additionally, enforce alignment constraints: Tx rings must be a multiple of 8, and Rx rings must be a multiple of 32.

Rincian

Terbit di NVD

15 Oktober 2025

Terakhir diubah

30 Juli 2026

Status NVD

Deferred

CVSS 3.1

8.8 (High), sumber CNA
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H · uraikan di kalkulator

EPSS (30 hari)

0,15% peluang dieksploitasi; lebih tinggi dari 4,0% CVE lain

Produk dan versi terdampak

NVD belum mencantumkan data produk (CPE) untuk CVE ini. Produk yang terdampak biasanya disebut di deskripsi dan di advisory vendor pada daftar referensi.

Referensi dan perbaikan

• https://git.kernel.org/stable/c/0543d40d6513cdf1c7882811086e59a6455dfe97
• https://git.kernel.org/stable/c/05fe81fb9db20464fa532a3835dc8300d68a2f84
• https://git.kernel.org/stable/c/45a7527cd7da4cdcf3b06b5c0cb1cae30b5a5985
• https://git.kernel.org/stable/c/55d225670def06b01af2e7a5e0446fbe946289e8
• https://git.kernel.org/stable/c/7d749e38dd2b7e8a80da2ca30c93e09de95bfcf9
• https://git.kernel.org/stable/c/afec12adab55d10708179a64d95d650741e60fe0
• https://git.kernel.org/stable/c/c0c83f4cd074b75cecef107bfc349be7d516c9c4
• https://git.kernel.org/stable/c/d3b0d3f8d11fa957171fbb186e53998361a88d4e