Executive brief
The iavf (Intel Adaptive Virtual Function) driver in the Linux kernel contains a memory safety flaw that can occur during device removal. When network channel parameters are changed during driver shutdown and a reset operation times out, the driver incorrectly updates queue counters without validating the allocated buffer size, leading to out-of-bounds memory access. This can cause system crashes or potentially allow local code execution with elevated privileges.
Technical details
The vulnerability is a heap out-of-bounds access (CWE-122) in the iavf driver's remove path. When iavf_remove() is called and the driver attempts to change the number of channels (via ethtool -L), if the reset operation times out, the code modifies num_active_queues without corresponding reallocation of the tx/rx_rings arrays. Subsequent access to these arrays in iavf_free_all_tx_resources() and iavf_free_all_rx_resources() then reads past allocated memory. The vulnerability is triggered locally through race conditions between SR-IOV configuration (sriov_numvfs) and ethtool channel commands. A patch resolving the issue by properly handling the reset timeout and not modifying queue counts on failure is available in the Linux kernel.
Affected products
- Linux Linux kernel Affected versions prior to patch
Timeline
- 2025-10-07: disclosed