Executive brief
A vulnerability in the Linux kernel's Intel i40e network driver could allow a local user to cause a system crash or potentially access sensitive memory. This issue occurs when the driver attempts to process network hardware addresses from an empty list, leading to an invalid memory access. This could impact the stability and availability of servers using Intel Ethernet controllers.
Technical details
An out-of-bounds read vulnerability exists in the i40e network driver (specifically in i40e_client.c) due to the use of list_first_entry() on a potentially empty MAC address list. In the Linux kernel, list_first_entry() does not return NULL for empty lists; instead, it returns a pointer to an invalid object derived from the list head. When this pointer is subsequently dereferenced in i40e_client_add_instance(), it results in an invalid memory access. An attacker with local access could exploit this to cause a denial of service (kernel panic) or read sensitive kernel memory. The fix replaces the vulnerable call with list_first_entry_or_null() and adds a proper NULL check.
Affected products
- Linux Linux Kernel 4.6 to 5.4.299, 5.5 to 5.10.243, 5.11 to 5.15.192, 5.16 to 6.1.151, 6.2 to 6.6.105, 6.7 to 6.12.46, 6.13 to 6.16.6
Timeline
- 2025-08-27: other: Vulnerability fix authored
- 2025-09-19: disclosed: CVE published
- 2025-09-19: patched: Fix merged into stable kernel branches
References
- https://git.kernel.org/stable/c/1eadabcf5623f1237a539b16586b4ed8ac8dffcd
- https://git.kernel.org/stable/c/3c6fb929afa313d9d11f780451d113f73922fe5d
- https://git.kernel.org/stable/c/66e7cdbda74ee823ec2bf7b830ebd235c54f5ddf
- https://git.kernel.org/stable/c/971feafe157afac443027acdc235badc6838560b
- https://git.kernel.org/stable/c/9c21fc4cebd44dd21016c61261a683af390343f8
- https://git.kernel.org/stable/c/a556f06338e1d5a85af0e32ecb46e365547f92b9
- https://git.kernel.org/stable/c/e2a5e74879f9b494bbd66fa93f355feacde450c7