LiveActive security incident?Get immediate response
CVE Record

CVE-2025-39972: i40e: fix idx validation in i40e_validate_queue_map

In the Linux kernel, the following vulnerability has been resolved: i40e: fix idx validation in i40e_validate_queue_map Ensure idx is within range of active/initialized TCs when iterating over vf->ch[idx] in i40e_validate_queue_map().

HighCVSS 8.8Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysishigh

Security readout for executives and security teams

Plain-English summary

A Linux i40e network-driver check could allow an index outside the active or initialized traffic classes when handling a virtual-function queue map. The supplied CVSS assessment indicates potentially severe confidentiality, integrity, and availability consequences, but the bundle does not describe a demonstrated outcome. Risk is concentrated on affected systems using this driver and functionality.

Executive priority

Treat this as a high-priority kernel maintenance issue on hosts using i40e virtual-function networking, especially shared or multi-user infrastructure. Prompt patching is justified by the 8.8 score and potential system-wide impact. An emergency response is not supported solely by this bundle because it supplies no evidence of active exploitation. Lower priority only after confirming the affected code is absent or unreachable.

Technical view

CVE-2025-39972 affects index validation in i40e_validate_queue_map(). While iterating over vf->ch[idx], the fix ensures idx remains within active or initialized traffic-class bounds. CVSS 3.1 scores it 8.8 with local access, low complexity, low privileges, no user interaction, changed scope, and high potential impact across confidentiality, integrity, and availability.

Likely exposure

Most plausible exposure is an affected Linux kernel with the i40e driver active and virtual-function traffic-class queue mapping in use. The bundle lists release boundaries spanning 4.17 through 6.17, but its flattened version data does not establish precise affected ranges or distribution package versions. Confirm exposure through kernel-vendor mapping and patch provenance.

Exploitation context

The CVSS vector requires local access and low privileges; it does not indicate a network-direct attack. The bundle marks this CVE as absent from KEV and provides no evidence of active exploitation, public exploit code, or successful attacks. Driver configuration and reachability of the affected virtual-function queue-map path will materially influence practical risk.

Researcher notes

The record identifies a bounds-validation correction around vf->ch[idx], but supplies no CWE, crash trace, proof of concept, attack narrative, or demonstrated security impact. Eight stable commits are referenced without explicit branch mapping in the flattened bundle. Validate ancestry or vendor backports directly. Treat the CVSS consequences as assessed potential, not proof of a specific corruption primitive.

Mitigation direction

  • Upgrade to a vendor kernel confirmed to contain the applicable upstream stable fix.
  • Match the installed kernel branch to its corresponding referenced kernel.org commit.
  • If patching is delayed, consult vendor guidance and reduce untrusted local access to affected hosts.
  • Prioritize systems using i40e virtual functions or traffic-class queue configuration.

Validation and detection

  • Inventory kernel versions and identify systems where the i40e driver is present and active.
  • Determine whether virtual-function channel or traffic-class queue mapping is used.
  • Confirm the installed vendor kernel includes its backport of an applicable referenced stable commit.
  • After updating, regression-test virtual-function networking and queue configuration.
  • Recheck vendor advisories for precise distribution package and affected-version boundaries.
Prepared
Confidence
medium
Sources
10

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2025-39972 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
High
CVSS
8.8 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
3Timeline events
0ADP providers
9Source links

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
8.8CVSS 3.1HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H26Linux

Vulnerability scoring details

Base CVSS 3.1 score

8.8High
CVSS 3.1 vector shape for CVE-2025-39972Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinuxc27eac48160de72dee33d42b5a33cc7b8a2eb1f5, c27eac48160de72dee33d42b5a33cc7b8a2eb1f5, c27eac48160de72dee33d42b5a33cc7b8a2eb1f5, c27eac48160de72dee33d42b5a33cc7b8a2eb1f5, c27eac48160de72dee33d42b5a33cc7b8a2eb1f5, c27eac48160de72dee33d42b5a33cc7b8a2eb1f5, c27eac48160de72dee33d42b5a33cc7b8a2eb1f5, c27eac48160de72dee33d42b5a33cc7b8a2eb1f5unaffected
LinuxLinux4.17, 0, 5.4.300, 5.10.245, 5.15.194, 6.1.155, 6.6.109, 6.12.50, 6.16.10, 6.17affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.