Security readout for executives and security teams
Plain-English summary
A compatibility failure in Linux’s ixgbevf virtual network driver can enable unsupported mailbox features between Intel 10GbE physical and virtual functions. Certain driver combinations may crash or lose IPsec or ESX mailbox functionality. Risk is concentrated in virtualized systems using this hardware and driver, not ordinary Linux hosts without ixgbevf.
Executive priority
Treat as high priority for virtualization infrastructure using Intel 10GbE SR-IOV and ixgbevf, especially where untrusted tenants receive virtual functions. Other systems have low likely exposure. Patch during the next expedited maintenance window after confirming vendor applicability; investigate immediately if mailbox-related crashes or network instability are already occurring.
Technical view
Mailbox API versions 1.4 through 1.6 implied capabilities that some PF drivers did not implement. ixgbevf could consequently activate incompatible IPsec or ESX-enhanced mailbox behavior. The resolution introduces explicit PF feature negotiation. CVSS 3.1 scores this 7.8 with local access, low privileges, low complexity, no user interaction, and high potential confidentiality, integrity, and availability impact.
Likely exposure
Most likely exposure is a Linux guest or virtualized host using the ixgbevf VF driver with an Intel 10GbE adapter and an incompatible PF implementation. The supplied version data identifies affected Linux releases but is ambiguous about ranges and backports; distribution-specific advisories should determine whether an installed kernel contains a fix.
Exploitation context
The CVSS vector describes a local, low-privileged attack path requiring no user interaction. The supplied sources document crashes and compatibility regressions, but provide no confirmed exploitation mechanism. The CVE is not listed as KEV, and this bundle contains no evidence of active exploitation or a public exploit.
Researcher notes
The core defect is capability inference from mailbox API versions instead of explicit feature negotiation. Historical changes introduced Linux-specific IPsec and ESX-specific enhanced mailbox behavior without interoperable negotiation. The bundle does not identify a CWE, proven exploit primitive, affected adapter models, or precise distribution package boundaries. Avoid equating the CVSS impact ratings with demonstrated data compromise.
Mitigation direction
- Install a vendor-supported kernel containing the applicable stable fix or an equivalent distribution backport.
- Prioritize virtualized systems using ixgbevf with Intel 10GbE SR-IOV virtual functions.
- Check Linux distribution advisories because package versions may include fixes through backports.
- Where immediate updating is impossible, consult vendor guidance before changing VF, IPsec, or mailbox configurations.
Validation and detection
- Inventory systems for loaded or configured ixgbevf virtual-function drivers.
- Identify the physical-function driver and mailbox API combination used by each exposed virtual function.
- Confirm the running kernel package contains the relevant upstream fix or distribution backport.
- After updating, test network stability and required IPsec or ESX mailbox functionality.
- Monitor kernel and driver logs for mailbox negotiation failures, resets, or crashes.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2025-40104 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9LinuxVulnerability scoring details
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/871ac1cd4ce4804defcb428cbb003fd84c415ff4CVE reference, Linux
- https://git.kernel.org/stable/c/2e0aab9ddaf1428602c78f12064cd1e6ffcc4d18CVE reference, Linux
- https://git.kernel.org/stable/c/bf580112ed61736c2645a893413a04732505d4b1CVE reference, Linux
- https://git.kernel.org/stable/c/a376e29b1b196dc90b50df7e5e3947e3026300c4CVE reference, Linux
- https://git.kernel.org/stable/c/a7075f501bd33c93570af759b6f4302ef0175168CVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.