CVE-2025-39969

Linux Kernel < 5.4.300, 5.5.0-6.16.10 - Resource Validation Bypass in i40e VF

Title source: llm
STIX 2.1

Description

In the Linux kernel, the following vulnerability has been resolved: i40e: fix validation of VF state in get resources VF state I40E_VF_STATE_ACTIVE is not the only state in which VF is actually active so it should not be used to determine if a VF is allowed to obtain resources. Use I40E_VF_STATE_RESOURCES_LOADED that is set only in i40e_vc_get_vf_resources_msg() and cleared during reset.

References (8)

Core 8

Scores

EPSS 0.0020
EPSS Percentile 9.7%

Details

Status published
Products (27)
linux/Kernel < 5.4.300linux
linux/Kernel 5.11.0 - 5.15.194linux
linux/Kernel 5.16.0 - 6.6.109linux
linux/Kernel 5.5.0 - 5.10.245linux
linux/Kernel 6.2.0 - 6.12.50linux
linux/Kernel 6.7.0 - 6.16.10linux
Linux/Linux < 5.16
Linux/Linux 171527da84149c2c7aa6a60a64b09d24f3546298 - 185745d56ec958bf8aa773828213237dfcc32f5a
Linux/Linux 2132643b956f553f5abddc9bae20dae267b082e0 - 8e35c80f8570426fe0f0cc92b151ebd835975f22
Linux/Linux 5.10.245 - 5.10.*
... and 17 more
Published Oct 15, 2025
Tracked Since Feb 18, 2026