Security readout for executives and security teams
Plain-English summary
A Linux i40e network-driver flaw can allow a locally privileged user to trigger improper queue-index handling for a virtual function. The supplied CVSS assessment indicates potentially severe confidentiality, integrity, and availability impact, but the public description does not document a demonstrated attack or specific operational outcome.
Executive priority
Treat this as a high-priority infrastructure patch for exposed virtualization or network hosts, especially where less-trusted users or workloads can influence virtual-function queues. Prioritize by confirmed i40e usage and path reachability rather than applying emergency status to every Linux system.
Technical view
The i40e_vc_config_queues_msg() function iterated over vf->ch[idx] without ensuring idx referred to an active, initialized traffic class. Stable-kernel changes add the missing validation. CVSS 3.1 scores it 8.8 with local access, low complexity, low privileges, no user interaction, and changed scope.
Likely exposure
Exposure is most likely on affected Linux kernels using the i40e driver and virtual-function queue configuration. Merely running Linux is insufficient evidence of exposure. The supplied version data is ambiguous, so kernel vendor advisories and backport status must determine whether each installed build is vulnerable.
Exploitation context
The CVSS vector requires local access and low privileges; this is not described as remotely exploitable. CISA KEV status is false in the supplied bundle, and no cited evidence establishes active exploitation or a public proof of concept. Practical reachability depends on access to the affected virtual-function configuration path.
Researcher notes
The record supplies no CWE, crash trace, proof of concept, or detailed impact demonstration. The affected-version entries include unusual and duplicated values, limiting precise range interpretation. Validate ancestry or distributor backports against the linked stable commits; do not infer vulnerability solely from a displayed kernel version.
Mitigation direction
- Obtain the kernel package containing the applicable stable fix or distributor backport.
- Prioritize hosts using i40e virtual functions and delegated queue configuration.
- Follow Linux distributor guidance where package versions differ from upstream versions.
- Restrict untrusted access to affected virtual-function management paths pending remediation.
Validation and detection
- Inventory running kernel builds and determine whether the i40e driver is active.
- Identify hosts using virtual functions and multiple traffic classes.
- Verify each kernel package includes the applicable referenced fix or vendor backport.
- After updating, confirm the remediated kernel is running, not merely installed.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2025-39971 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 8.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H26LinuxVulnerability scoring details
Base CVSS 3.1 score
8.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/a6ff2af78343eceb0f77ab1a2fe802183bc21648CVE reference, Linux
- https://git.kernel.org/stable/c/f5f91d164af22e7147130ef8bebbdb28d8ecc6e2CVE reference, Linux
- https://git.kernel.org/stable/c/1fa0aadade34481c567cdf4a897c0d4e4d548bd1CVE reference, Linux
- https://git.kernel.org/stable/c/8b9c7719b0987b1c6c5fc910599f3618a558dbdeCVE reference, Linux
- https://git.kernel.org/stable/c/2cc26dac0518d2fa9b67ec813ee60e183480f98aCVE reference, Linux
- https://git.kernel.org/stable/c/bfcc1dff429d4b99ba03e40ddacc68ea4be2b32bCVE reference, Linux
- https://git.kernel.org/stable/c/5c1f96123113e0bdc6d8dc2b0830184c93da9f65CVE reference, Linux
- https://git.kernel.org/stable/c/f1ad24c5abe1eaef69158bac1405a74b3c365115CVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.