CVE-2025-39911
BaseFortify
Publication date: 2025-10-01
Last updated on: 2025-11-03
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| linux | linux | 6.1.153-1 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-UNKNOWN |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is in the Linux kernel's i40e network driver. When the function i40e_vsi_request_irq_msix() tries to request multiple IRQs (interrupt requests) and fails after the first one, it attempts to free the IRQs it has already requested. However, it uses the wrong device identifier (dev_id) when calling free_irq(), which causes the IRQs not to be freed correctly and triggers a kernel warning about trying to free an already freed IRQ. The fix involves using the same dev_id for free_irq() as was used for request_irq().
How can this vulnerability impact me? :
This vulnerability can cause improper freeing of IRQs in the i40e network driver, leading to kernel warnings and potentially unstable behavior in the network driver or the kernel. It may cause resource leaks or unexpected errors during network device initialization or operation, which could affect system stability or network functionality.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by monitoring the system logs for the specific warning message triggered by the incorrect free_irq() call. Look for the warning: 'Trying to free already-free IRQ <number>' along with kernel warnings referencing __free_irq and the i40e module. You can use commands like 'dmesg | grep -i "Trying to free already-free IRQ"' or 'journalctl -k | grep i40e' to find such warnings in kernel logs.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, update the Linux kernel to a version where the i40e driver has been fixed to use the correct dev_id argument in free_irq(). If updating immediately is not possible, monitor for the warning messages and avoid triggering the error path in i40e_vsi_request_irq_msix(), such as by limiting network interface operations that may cause IRQ request failures.