Security readout for executives and security teams
Plain-English summary
A boundary-check error in the Linux i40e network driver can allow an out-of-bounds memory dereference. The supplied CVSS assessment indicates that a local user with limited privileges could potentially compromise confidentiality, integrity, and availability. Exposure is limited to affected kernels where the vulnerable driver path is reachable.
Executive priority
Treat this as a high-priority kernel maintenance issue on exposed i40e systems, especially shared or multi-user infrastructure. It is not presented as an unauthenticated remote emergency, and active exploitation is not evidenced. Expedite inventory and vendor-supported updates while confirming actual driver use.
Technical view
The i40e driver validated action_meta using an incorrect boundary condition. An index equal to the permitted limit could therefore pass validation and cause an out-of-bounds dereference. The kernel fix changes the condition to reject values greater than or equal to that limit.
Likely exposure
Prioritize systems running the listed affected Linux versions and using the i40e driver. The bundle lists versions from 4.17 through 6.17, but does not provide complete range semantics or distribution-specific package mappings. The duplicated commit data and default-status fields make exact exposure uncertain.
Exploitation context
The CVSS vector describes local, low-complexity exploitation requiring low privileges and no user interaction. The bundle marks this CVE as absent from KEV and provides no evidence of active exploitation, public proof-of-concept availability, or remote exploitation.
Researcher notes
The supplied record identifies an off-by-one-style validation failure leading to an out-of-bounds dereference. Stable-tree fix commits are available, but the bundle does not establish the affected code path, exploitation primitive, distribution backports, or practical impact beyond the CVSS assessment. Avoid inferring exploitability without code-level and vendor-package validation.
Mitigation direction
- Update to a vendor-supported kernel containing the applicable stable i40e fix.
- Check distribution or appliance vendor guidance for corrected package versions.
- Prioritize multi-user and other systems where untrusted local users may access the vulnerable path.
Validation and detection
- Inventory deployed kernel versions and systems using the i40e driver.
- Compare kernel builds with the applicable stable fix or downstream vendor advisory.
- Confirm the corrected kernel is active after updating and rebooting.
- Reassess local accounts and workloads able to reach relevant driver functionality.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2025-39970 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 8.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H26LinuxVulnerability scoring details
Base CVSS 3.1 score
8.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/a88c1b2746eccf00e2094b187945f0f1e990b400CVE reference, Linux
- https://git.kernel.org/stable/c/28465770ca3b694286ff9ed6dfd558413f57d98fCVE reference, Linux
- https://git.kernel.org/stable/c/f8c8e11825b24661596fa8db2f0981ba17ed0817CVE reference, Linux
- https://git.kernel.org/stable/c/461e0917eedcd159d87f3ea846754a1e07d7e78aCVE reference, Linux
- https://git.kernel.org/stable/c/3883e9702b6a4945e93b16c070f338a9f5b496f9CVE reference, Linux
- https://git.kernel.org/stable/c/3118f41d8fa57b005f53ec3db2ba5eab1d7ba12bCVE reference, Linux
- https://git.kernel.org/stable/c/560e1683410585fbd5df847f43433c4296f0d222CVE reference, Linux
- https://git.kernel.org/stable/c/9739d5830497812b0bdeaee356ddefbe60830b88CVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.