Skip to content
Heist/ feed
High

i40e: add validation for ring_len param

Type: advisorySource: Official CVE List1 source record

In the Linux kernel, the following vulnerability has been resolved: i40e: add validation for ring_len param The `ring_len` parameter provided by the virtual function (VF) is assigned directly to the hardware memory context (HMC) without any validation. To address this, introduce an upper boundary check for both Tx and Rx queue lengths. The maximum number of descriptors supported by the hardware is 8k-32. Additionally, enforce alignment constraints: Tx rings must be a multiple of 8, and Rx rings must be a multiple of 32.

Announced Source revision 1
Original source ↗

CVE-2025-39973

Primary source · Revision 1

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: cve:CVE-2025-39973

Linux

Source reference: /containers/cna/affected/0/product

Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

Linux

Source reference: /containers/cna/affected/1/product

Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

Structured affected-version data

Original package identities and version rules from this source.

[
  {
    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
    "vendor": "Linux",
    "product": "Linux",
    "versions": [
      {
        "status": "affected",
        "version": "5c3c48ac6bf56367c4e89f6453cd2d61e50375bd",
        "lessThan": "0543d40d6513cdf1c7882811086e59a6455dfe97",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "5c3c48ac6bf56367c4e89f6453cd2d61e50375bd",
        "lessThan": "7d749e38dd2b7e8a80da2ca30c93e09de95bfcf9",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "5c3c48ac6bf56367c4e89f6453cd2d61e50375bd",
        "lessThan": "45a7527cd7da4cdcf3b06b5c0cb1cae30b5a5985",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "5c3c48ac6bf56367c4e89f6453cd2d61e50375bd",
        "lessThan": "d3b0d3f8d11fa957171fbb186e53998361a88d4e",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "5c3c48ac6bf56367c4e89f6453cd2d61e50375bd",
        "lessThan": "c0c83f4cd074b75cecef107bfc349be7d516c9c4",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "5c3c48ac6bf56367c4e89f6453cd2d61e50375bd",
        "lessThan": "05fe81fb9db20464fa532a3835dc8300d68a2f84",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "5c3c48ac6bf56367c4e89f6453cd2d61e50375bd",
        "lessThan": "afec12adab55d10708179a64d95d650741e60fe0",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "5c3c48ac6bf56367c4e89f6453cd2d61e50375bd",
        "lessThan": "55d225670def06b01af2e7a5e0446fbe946289e8",
        "versionType": "git"
      }
    ],
    "programFiles": [
      "drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c"
    ],
    "defaultStatus": "unaffected"
  },
  {
    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
    "vendor": "Linux",
    "product": "Linux",
    "versions": [
      {
        "status": "affected",
        "version": "3.12"
      },
      {
        "status": "unaffected",
        "version": "0",
        "lessThan": "3.12",
        "versionType": "semver"
      },
      {
        "status": "unaffected",
        "version": "5.4.300",
        "versionType": "semver",
        "lessThanOrEqual": "5.4.*"
      },
      {
        "status": "unaffected",
        "version": "5.10.245",
        "versionType": "semver",
        "lessThanOrEqual": "5.10.*"
      },
      {
        "status": "unaffected",
        "version": "5.15.194",
        "versionType": "semver",
        "lessThanOrEqual": "5.15.*"
      },
      {
        "status": "unaffected",
        "version": "6.1.155",
        "versionType": "semver",
        "lessThanOrEqual": "6.1.*"
      },
      {
        "status": "unaffected",
        "version": "6.6.109",
        "versionType": "semver",
        "lessThanOrEqual": "6.6.*"
      },
      {
        "status": "unaffected",
        "version": "6.12.50",
        "versionType": "semver",
        "lessThanOrEqual": "6.12.*"
      },
      {
        "status": "unaffected",
        "version": "6.16.10",
        "versionType": "semver",
        "lessThanOrEqual": "6.16.*"
      },
      {
        "status": "unaffected",
        "version": "6.17",
        "versionType": "original_commit_for_fix",
        "lessThanOrEqual": "*"
      }
    ],
    "programFiles": [
      "drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c"
    ],
    "defaultStatus": "affected"
  }
]
Related CVEs
CVE-2025-39973

Source reference: /cveMetadata/cveId

Publisher severity

high

Source reference: /containers/cna/metrics

Event
#30652 · Revision 1
Added to Heist Feed
Publisher date
Read the original announcement