Executive brief
A security vulnerability has been identified in the Linux kernel's Intel i40e network driver. This driver is responsible for managing high-speed Intel Ethernet controllers often used in data centers and enterprise servers. An attacker with local access could exploit this flaw to potentially gain unauthorized access to system memory or cause a complete system crash, impacting the overall security and availability of the host.
Technical details
An out-of-bounds read/write vulnerability exists in the i40e driver within the 'i40e_validate_queue_map' function. The root cause is a failure to validate the 'idx' variable against the number of active Traffic Classes (TCs) when Application Device Queues (ADq) are enabled. A local attacker can leverage this lack of bounds checking when iterating over the 'vf->ch[idx]' array to access memory outside of the intended buffer. This issue affects systems using Intel Ethernet 700 Series controllers and has been addressed in multiple stable kernel branches including 5.4.y, 5.10.y, 5.15.y, and later.
Affected products
- Linux Linux Kernel 4.17 to 6.13.y
Timeline
- 2025-08-13: other: Patch authored by Intel engineers
- 2025-10-15: advisory: CVE published and NVD record created
References
- https://git.kernel.org/stable/c/34dfac0c904829967d500c51f216916ce1452957
- https://git.kernel.org/stable/c/4d5e804a9e19b639b18fd13664dbad3c03c79e61
- https://git.kernel.org/stable/c/50a1e2f50f6c22b93b94eb8d168a1be3c05bf5cd
- https://git.kernel.org/stable/c/6f15a7b34fae75e745bdc2ec05e06ddfd0dd2f3c
- https://git.kernel.org/stable/c/aa68d3c3ac8d1dcec40d52ae27e39f6d32207009
- https://git.kernel.org/stable/c/b6cb93a7ff208f324c7ec581d72995f80e115e0e
- https://git.kernel.org/stable/c/cc4191e8ef40d2249c1b9a8617d22ec8a976b574