Executive brief
A vulnerability was identified in the Linux kernel's Intel i40e network driver. A local user with access to a virtual machine could provide invalid network configuration parameters that are processed by the host system without proper validation. This could allow an attacker to compromise the host system's stability or gain unauthorized access to data, potentially leading to a full system takeover.
Technical details
A vulnerability in the i40e driver's virtual function (VF) interface allows for an out-of-bounds or invalid memory state. The 'ring_len' parameter provided by a VF was assigned directly to the hardware memory context (HMC) without validation. An attacker with local access to a guest VM could exploit this to trigger memory corruption or system instability on the host. The fix introduces upper boundary checks (maximum 8k-32 descriptors) and alignment constraints (multiples of 8 for Tx and 32 for Rx) in 'i40e_virtchnl_pf.c'. Patches are available in various stable kernel branches including 5.4.300, 5.10.245, 5.15.194, and 6.11.2.
Affected products
- Linux Linux Kernel 3.12 to 6.11.2
Timeline
- 2025-10-15: advisory: Initial publication of the CVE record.
- 2025-10-02: patched: Fixes merged into stable kernel branches.
References
- https://git.kernel.org/stable/c/0543d40d6513cdf1c7882811086e59a6455dfe97
- https://git.kernel.org/stable/c/05fe81fb9db20464fa532a3835dc8300d68a2f84
- https://git.kernel.org/stable/c/45a7527cd7da4cdcf3b06b5c0cb1cae30b5a5985
- https://git.kernel.org/stable/c/55d225670def06b01af2e7a5e0446fbe946289e8
- https://git.kernel.org/stable/c/7d749e38dd2b7e8a80da2ca30c93e09de95bfcf9
- https://git.kernel.org/stable/c/afec12adab55d10708179a64d95d650741e60fe0
- https://git.kernel.org/stable/c/c0c83f4cd074b75cecef107bfc349be7d516c9c4