LiveActive security incident?Get immediate response
CVE Record

CVE-2025-39956: igc: don't fail igc_probe() on LED setup error

In the Linux kernel, the following vulnerability has been resolved: igc: don't fail igc_probe() on LED setup error When igc_led_setup() fails, igc_probe() fails and triggers kernel panic in free_netdev() since unregister_netdev() is not called. [1] This behavior can be tested using fault-injection framework, especially the failslab feature. [2] Since LED support is not mandatory, treat LED setup failures as non-fatal and continue probe with a warning message, consequently avoiding the kernel panic. [1] kernel BUG at net/core/dev.c:12047! Oops: invalid opcode: 0000 [#1] SMP NOPTI CPU: 0 UID: 0 PID: 937 Comm: repro-igc-led-e Not tainted 6.17.0-rc4-enjuk-tnguy-00865-gc4940196ab02 #64 PREEMPT(voluntary) Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 RIP: 0010:free_netdev+0x278/0x2b0 [...] Call Trace: <TASK> igc_probe+0x370/0x910 local_pci_probe+0x3a/0x80 pci_device_probe+0xd1/0x200 [...] [2] #!/bin/bash -ex FAILSLAB_PATH=/sys/kernel/debug/failslab/ DEVICE=0000:00:05.0 START_ADDR=$(grep " igc_led_setup" /proc/kallsyms \ | awk '{printf("0x%s", $1)}') END_ADDR=$(printf "0x%x" $((START_ADDR + 0x100))) echo $START_ADDR > $FAILSLAB_PATH/require-start echo $END_ADDR > $FAILSLAB_PATH/require-end echo 1 > $FAILSLAB_PATH/times echo 100 > $FAILSLAB_PATH/probability echo N > $FAILSLAB_PATH/ignore-gfp-wait echo $DEVICE > /sys/bus/pci/drivers/igc/bind

HighCVSS 7.8Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysishigh

Security readout for executives and security teams

Plain-English summary

A failure while setting up optional LED support for an Intel igc network adapter can take down the Linux kernel during device initialization. The demonstrated result is a kernel panic, which can interrupt services and require recovery or reboot. The source does not demonstrate data theft or remote exploitation.

Executive priority

Treat this as a high-priority availability issue for systems using igc adapters, particularly critical servers and appliances where a kernel panic causes material downtime. Patch through supported kernel channels after confirming vendor applicability. Fleets without the igc driver have substantially lower likely exposure.

Technical view

If igc_led_setup() fails, igc_probe() follows an incorrect cleanup path: free_netdev() is reached without unregister_netdev(), triggering a kernel BUG and panic. The fix treats LED setup failure as non-fatal, logs a warning, and continues probing. CVSS 3.1 is 7.8 with local, low-privileged access specified.

Likely exposure

Exposure is limited to affected Linux kernels on systems using the igc Ethernet driver where LED setup fails during device probing. The supplied version data references 6.9, 6.12.49, 6.16.9, and 6.17, but its exact range semantics are unclear. Distribution backports require separate verification.

Exploitation context

The CVE is not listed as KEV, and the supplied sources provide no evidence of active exploitation. Reproduction used kernel fault injection to force allocation failure. Although the CVSS vector specifies local low-privileged access, the evidence does not establish that an ordinary local user can reliably trigger the condition.

Researcher notes

The root cause is faulty probe-error cleanup after igc_led_setup() failure. The resolution preserves operation because LED support is optional. The bundle supplies three stable commits, but affected-version metadata is ambiguous and includes an unexplained "0" entry. Validate exact upstream ancestry and downstream backports before declaring a build vulnerable.

Mitigation direction

  • Update to a vendor-supported kernel containing the cited fix or a confirmed backport, then reboot into it.
  • Check distribution or appliance vendor guidance for exact affected builds and remediation availability.
  • Until patched, restrict unnecessary local access on exposed systems using the igc driver.
  • Prioritize systems where network-device probing or rebinding occurs operationally.

Validation and detection

  • Inventory deployed kernel versions, distribution build identifiers, and systems loading the igc driver.
  • Confirm vendor changelogs or kernel source include one of the cited fixes or an equivalent backport.
  • After updating, verify systems booted the intended kernel and igc network devices initialize normally.
  • Review kernel logs for free_netdev BUG traces or panics associated with igc_probe.
Prepared
Confidence
medium
Sources
5

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2025-39956 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
High
CVSS
7.8 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
3Timeline events
0ADP providers
4Source links

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
7.8CVSS 3.1HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9Linux

Vulnerability scoring details

Base CVSS 3.1 score

7.8High
CVSS 3.1 vector shape for CVE-2025-39956Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinuxea578703b03d5d651b091c39f717dc829155b520, ea578703b03d5d651b091c39f717dc829155b520, ea578703b03d5d651b091c39f717dc829155b520unaffected
LinuxLinux6.9, 0, 6.12.49, 6.16.9, 6.17affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.