vulntracker.iovulntracker.io
© 2026 vulntracker.io

CVE-2025-39973

i40e: add validation for ring_len param

HIGH
8.8
CVSS Score
Published: October 15, 2025 at 07:55 AM UTC
Updated: October 19, 2026 at 09:10 PM UTC
1 product affected across 1 vendorLinux Kernel

Using Linux by Linux?

Get instant alerts when new vulnerabilities affect Linux - before attackers find them.

Real-time alertsTrack your software stackFree plan available
Start FreeSign In
Severity
HIGH8.8
Exploit prediction
EPSS 0.2%
SSVC
No known exploit

Description

In the Linux kernel, the following vulnerability has been resolved: i40e: add validation for ring_len param The `ring_len` parameter provided by the virtual function (VF) is assigned directly to the hardware memory context (HMC) without any validation. To address this, introduce an upper boundary check for both Tx and Rx queue lengths. The maximum number of descriptors supported by the hardware is 8k-32. Additionally, enforce alignment constraints: Tx rings must be a multiple of 8, and Rx rings must be a multiple of 32.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Linux Kernel· Linux
90%
3.125c3c48ac6bf56367c4e89f6453cd2d61e50375bd
Vendor states this is fixed in 0543d40d6513cdf1c7882811086e59a6455dfe97 (fixed)
Vendor states this is fixed in 05fe81fb9db20464fa532a3835dc8300d68a2f84 (fixed)
Vendor states this is fixed in 45a7527cd7da4cdcf3b06b5c0cb1cae30b5a5985 (fixed)
Vendor states this is fixed in 55d225670def06b01af2e7a5e0446fbe946289e8 (fixed)
Vendor states this is fixed in 7d749e38dd2b7e8a80da2ca30c93e09de95bfcf9 (fixed)
Vendor states this is fixed in afec12adab55d10708179a64d95d650741e60fe0 (fixed)
Vendor states this is fixed in c0c83f4cd074b75cecef107bfc349be7d516c9c4 (fixed)
Vendor states this is fixed in d3b0d3f8d11fa957171fbb186e53998361a88d4e (fixed)
Vendor states this is fixed in 3.12 (unaffected)
Vendor states this is fixed in 5.10.245 (unaffected)
Vendor states this is fixed in 5.15.194 (unaffected)
Vendor states this is fixed in 5.4.300 (unaffected)
Vendor states this is fixed in 6.1.155 (unaffected)
Vendor states this is fixed in 6.12.50 (unaffected)
Vendor states this is fixed in 6.16.10 (unaffected)
Vendor states this is fixed in 6.17 (unaffected)
Vendor states this is fixed in 6.6.109 (unaffected)

Remediation

No guide yet

No remediation guidance has been written for this CVE yet, and no fixed version or vendor advisory is recorded against it.

References (8)

Source: cverecord
https://git.kernel.org/stable/c/0543d40d6513cdf1c7882811086e59a6455dfe97
Source: cverecord
https://git.kernel.org/stable/c/7d749e38dd2b7e8a80da2ca30c93e09de95bfcf9
Source: cverecord
https://git.kernel.org/stable/c/45a7527cd7da4cdcf3b06b5c0cb1cae30b5a5985
Source: cverecord
https://git.kernel.org/stable/c/d3b0d3f8d11fa957171fbb186e53998361a88d4e
Source: cverecord
https://git.kernel.org/stable/c/c0c83f4cd074b75cecef107bfc349be7d516c9c4
Source: cverecord
https://git.kernel.org/stable/c/05fe81fb9db20464fa532a3835dc8300d68a2f84
Source: cverecord
https://git.kernel.org/stable/c/afec12adab55d10708179a64d95d650741e60fe0
Source: cverecord
https://git.kernel.org/stable/c/55d225670def06b01af2e7a5e0446fbe946289e8

SSVC — Action Prioritization

SSVCNo known exploitNot automatableTotal impact

SSVC signals action urgency (what to patch first), separate from CVSS which measures severity.

CVSS

8.8HIGHLinux
Vector?

Quick Info

StatusDEFERRED

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Create accountSign in
Free plan, no card