Security readout for executives and security teams
Plain-English summary
A locally authorized Linux virtual function may request too many network filters from the i40e driver because the driver lacked a maximum-boundary check. The supplied CVSS assessment indicates possible major availability impact and limited integrity impact, but no confidentiality loss. Risk is concentrated on affected systems using i40e virtual-function filtering, rather than every Linux installation.
Executive priority
Treat this as a high-priority infrastructure issue where i40e virtual functions cross trust boundaries or support critical services. Schedule vendor-supported kernel remediation promptly. Lower the priority only after confirming the vulnerable path is unused or inaccessible; the evidence does not support an emergency internet-wide response.
Technical view
CVE-2025-39968 is an input-boundary flaw in the Linux kernel i40e driver's handling of virtual-function filter requests. The resolution adds a maximum filter check. CVSS 3.1 is 7.3: local access, low complexity, low privileges, no user interaction, changed scope, low integrity impact, and high availability impact.
Likely exposure
Prioritize Linux hosts running affected kernel code where i40e virtual functions can submit filter requests, particularly environments assigning such functions to less-trusted workloads. Hosts not using the relevant i40e virtual-function functionality are less likely to expose the vulnerable path. The supplied version data is ambiguous, so confirm applicability through the kernel or distribution vendor.
Exploitation context
Exploitation requires local, low-privileged access according to the supplied CVSS vector; this is not described as a remote network attack. The bundle marks the CVE as absent from KEV and provides no evidence of active exploitation or a public exploit. Absence from KEV does not prove exploitation is impossible.
Researcher notes
The record supplies only a short root-cause statement: no maximum check existed for filters requested by a virtual function. It does not identify a CWE, failure mode, affected hardware models, exploit proof, or precise fixed release mapping. Validate backports using the referenced stable commits and vendor advisories rather than version-string assumptions.
Mitigation direction
- Obtain a kernel update incorporating the applicable listed stable fix from your Linux distribution or kernel vendor.
- Prioritize hosts exposing i40e virtual functions to tenants, containers, virtual machines, or other less-trusted workloads.
- If updating is delayed, consult vendor guidance about safely restricting the affected virtual-function functionality.
- Do not infer fixed versions solely from the ambiguous version list in the supplied record.
Validation and detection
- Inventory kernel versions, i40e driver use, SR-IOV configuration, and assigned virtual functions across Linux hosts.
- Confirm the installed kernel contains the applicable stable commit or vendor backport.
- Identify which users or workloads can control i40e virtual functions and request filters.
- After updating, verify the running kernel package and confirm normal virtual-function networking behavior.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2025-39968 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.3 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:H24.7LinuxVulnerability scoring details
Base CVSS 3.1 score
7.3HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/9176e18681cb0d34c5acc87bda224f5652af2ab8CVE reference, Linux
- https://git.kernel.org/stable/c/e490d8c5a54e0dd1ab22417d72c3a7319cf0f030CVE reference, Linux
- https://git.kernel.org/stable/c/77a35be582dff4c80442ebcdce24d45eed8a6ce4CVE reference, Linux
- https://git.kernel.org/stable/c/02aae5fcdd34c3a55a243d80a1b328a35852a35cCVE reference, Linux
- https://git.kernel.org/stable/c/edecce7abd7152b48e279b4fa0a883d1839bb577CVE reference, Linux
- https://git.kernel.org/stable/c/d33e5d6631ac4fddda235a7815babc9d3f124299CVE reference, Linux
- https://git.kernel.org/stable/c/8b13df5aa877b9e4541e301a58a84c42d84d2d9aCVE reference, Linux
- https://git.kernel.org/stable/c/cb79fa7118c150c3c76a327894bb2eb878c02619CVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.