Executive brief
The i40e network driver in the Linux kernel contains a vulnerability in its debugfs debugging interface. When users read from the 'netdev_ops' debugfs file, the driver can incorrectly read beyond allocated memory buffers due to improper use of snprintf(), potentially exposing sensitive kernel data. This affects systems running Linux with the i40e driver and debugfs enabled, primarily impacting network appliances and servers using Intel 40-gigabit Ethernet adapters.
Technical details
The vulnerability is a heap buffer over-read in the i40e driver's debugfs read handler for the 'netdev_ops' file. The root cause is the use of snprintf() with a fixed-size static buffer that is shared across all devices managed by the driver. When user-crafted input is written to this debugfs file, it can be copied into the static buffer in a way that causes snprintf() to truncate output, leading to copy_to_user reading beyond the allocated buffer bounds on subsequent reads. No authentication is required—any user with access to debugfs (typically root or via debugfs mounts) can trigger this. An attacker can read arbitrary kernel memory, potentially leaking sensitive information. The fix involves removing read access to these debugging files and refactoring the write handler to use dynamically allocated buffers instead of the shared static buffer.
Affected products
- Linux Linux kernel versions with i40e driver and debugfs interface (legacy)
Timeline
- 2025-10-01: disclosed: CVE-2025-39901 published