vulntracker.iovulntracker.io
© 2026 vulntracker.io

CVE-2025-39969

i40e: fix validation of VF state in get resources

HIGH
8.8
CVSS Score
Published: October 15, 2025 at 07:55 AM UTC
Updated: October 19, 2026 at 09:10 PM UTC
1 product affected across 1 vendorLinux Kernel

Using Linux by Linux?

Get instant alerts when new vulnerabilities affect Linux - before attackers find them.

Real-time alertsTrack your software stackFree plan available
Start FreeSign In
Severity
HIGH8.8
Exploit prediction
EPSS 0.2%
SSVC
No known exploit

Description

In the Linux kernel, the following vulnerability has been resolved: i40e: fix validation of VF state in get resources VF state I40E_VF_STATE_ACTIVE is not the only state in which VF is actually active so it should not be used to determine if a VF is allowed to obtain resources. Use I40E_VF_STATE_RESOURCES_LOADED that is set only in i40e_vc_get_vf_resources_msg() and cleared during reset.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Linux Kernel· Linux
90%
171527da84149c2c7aa6a60a64b09d24f35462982132643b956f553f5abddc9bae20dae267b082e05.10.855.15.85.165.4.16561125b8be85dfbc7e9c7fe1cc6c6d631ab603516eb87117c27e729b0aeef4d72ed40d6a1761b0f68
Vendor states this is fixed in 185745d56ec958bf8aa773828213237dfcc32f5a (fixed)
Vendor states this is fixed in 6128bbc7adc25c87c2f64b5eb66a280b78ef7ab7 (fixed)
Vendor states this is fixed in 6c3981fd59ef11a75005ac9978f034da5a168b6a (fixed)
Vendor states this is fixed in 877b7e6ffc23766448236e8732254534c518ba42 (fixed)
Vendor states this is fixed in 8e35c80f8570426fe0f0cc92b151ebd835975f22 (fixed)
Vendor states this is fixed in a991dc56d3e9a2c3db87d0c3f03c24f6595400f1 (fixed)
Vendor states this is fixed in e748f1ee493f88e38b77363a60499f979d42c58a (fixed)
Vendor states this is fixed in f47876788a23de296c42ef9d505b5c1630f0b4b8 (fixed)
Vendor states this is fixed in 5.10.245 (unaffected)
Vendor states this is fixed in 5.15.194 (unaffected)
Vendor states this is fixed in 5.16 (unaffected)
Vendor states this is fixed in 5.4.300 (unaffected)
Vendor states this is fixed in 6.1.155 (unaffected)
Vendor states this is fixed in 6.12.50 (unaffected)
Vendor states this is fixed in 6.16.10 (unaffected)
Vendor states this is fixed in 6.17 (unaffected)
Vendor states this is fixed in 6.6.109 (unaffected)

Remediation

No guide yet

No remediation guidance has been written for this CVE yet, and no fixed version or vendor advisory is recorded against it.

References (8)

Source: cverecord
https://git.kernel.org/stable/c/185745d56ec958bf8aa773828213237dfcc32f5a
Source: cverecord
https://git.kernel.org/stable/c/f47876788a23de296c42ef9d505b5c1630f0b4b8
Source: cverecord
https://git.kernel.org/stable/c/8e35c80f8570426fe0f0cc92b151ebd835975f22
Source: cverecord
https://git.kernel.org/stable/c/6c3981fd59ef11a75005ac9978f034da5a168b6a
Source: cverecord
https://git.kernel.org/stable/c/e748f1ee493f88e38b77363a60499f979d42c58a
Source: cverecord
https://git.kernel.org/stable/c/6128bbc7adc25c87c2f64b5eb66a280b78ef7ab7
Source: cverecord
https://git.kernel.org/stable/c/a991dc56d3e9a2c3db87d0c3f03c24f6595400f1
Source: cverecord
https://git.kernel.org/stable/c/877b7e6ffc23766448236e8732254534c518ba42

SSVC — Action Prioritization

SSVCNo known exploitNot automatableTotal impact

SSVC signals action urgency (what to patch first), separate from CVSS which measures severity.

CVSS

8.8HIGHLinux
Vector?

Quick Info

StatusDEFERRED

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Create accountSign in
Free plan, no card