Security readout for executives and security teams
Plain-English summary
A low-privileged local user with access to an i40e network virtual function may supply an invalid queue length that the host trusts and programs into hardware. The supplied CVSS assessment indicates possible host-impacting confidentiality, integrity, and availability consequences. Risk is concentrated in systems exposing i40e virtual functions, rather than all Linux hosts.
Executive priority
Prioritize affected multi-tenant, virtualized, or otherwise less-trusted hosts because the supplied assessment indicates potential cross-boundary host impact. Treat remediation as high priority, while first confirming i40e virtual-function use. General Linux systems without this hardware and configuration should not receive the same urgency solely from this CVE.
Technical view
The Linux i40e driver assigned a VF-provided ring_len directly to the hardware memory context without validation. Stable fixes cap Tx and Rx queue lengths at the hardware maximum of 8,160 descriptors and require Tx lengths divisible by 8 and Rx lengths divisible by 32. The supplied CVSS 3.1 score is 8.8, with local, low-privilege access and changed scope.
Likely exposure
Likely exposure is limited to Linux hosts using the i40e driver and providing network virtual functions to less-trusted local workloads or tenants. Hosts without relevant i40e hardware, without enabled virtual functions, or already carrying a listed stable fix are less likely exposed. The bundle does not clearly define complete vulnerable version ranges, so distribution-specific confirmation is necessary.
Exploitation context
The supplied record is not listed in CISA KEV and provides no evidence of active exploitation or a public exploit. Exploitation requires local, low-privilege access according to the CVSS vector, plus an environment where the attacker can influence an i40e virtual function. Practical exploitability and resulting failure modes are not documented in the bundle.
Researcher notes
The key trust-boundary failure is acceptance of VF-controlled ring_len values into HMC configuration. The correction adds upper-bound and alignment checks for both queue types. The source bundle repeats one commit identifier in affected metadata and presents ambiguous version entries; researchers should rely on stable commits and distribution backport records rather than raw version strings alone.
Mitigation direction
- Apply the appropriate vendor or Linux stable kernel update containing the ring-length validation fix.
- Consult the Linux distribution advisory to map installed kernel builds to the listed fixes.
- Restrict untrusted access to i40e virtual functions until affected hosts are updated.
- If patching is delayed, disable unnecessary i40e virtual-function assignments after operational review.
Validation and detection
- Inventory hosts loading the i40e driver and identify those exposing virtual functions.
- Record each host's distribution kernel package and exact running kernel build.
- Confirm fix inclusion through distribution advisories or matching stable-kernel commits.
- After updating, reboot if required and verify the patched kernel is running.
- Review virtualization configuration for virtual functions assigned to untrusted workloads or tenants.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2025-39973 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 8.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H26LinuxVulnerability scoring details
Base CVSS 3.1 score
8.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/0543d40d6513cdf1c7882811086e59a6455dfe97CVE reference, Linux
- https://git.kernel.org/stable/c/7d749e38dd2b7e8a80da2ca30c93e09de95bfcf9CVE reference, Linux
- https://git.kernel.org/stable/c/45a7527cd7da4cdcf3b06b5c0cb1cae30b5a5985CVE reference, Linux
- https://git.kernel.org/stable/c/d3b0d3f8d11fa957171fbb186e53998361a88d4eCVE reference, Linux
- https://git.kernel.org/stable/c/c0c83f4cd074b75cecef107bfc349be7d516c9c4CVE reference, Linux
- https://git.kernel.org/stable/c/05fe81fb9db20464fa532a3835dc8300d68a2f84CVE reference, Linux
- https://git.kernel.org/stable/c/afec12adab55d10708179a64d95d650741e60fe0CVE reference, Linux
- https://git.kernel.org/stable/c/55d225670def06b01af2e7a5e0446fbe946289e8CVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.