CVE-2025-39956
BaseFortify
Publication date: 2025-10-09
Last updated on: 2026-02-26
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| linux | linux_kernel | 6.17 |
| linux | linux_kernel | From 6.13 (inc) to 6.16.9 (inc) |
| intel | igc | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-UNKNOWN |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability occurs in the Linux kernel's igc driver where if the LED setup function (igc_led_setup) fails during device probing (igc_probe), the probe function also fails and causes a kernel panic. This happens because the network device is not properly unregistered (unregister_netdev is not called), leading to a crash in free_netdev. The fix treats LED setup failures as non-fatal, allowing the probe to continue with a warning instead of causing a kernel panic.
How can this vulnerability impact me? :
This vulnerability can cause a kernel panic on systems using the affected Linux kernel igc driver if the LED setup fails. A kernel panic results in a system crash and potential downtime, which can disrupt services and require a reboot to recover. This may affect system stability and availability.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected using the Linux kernel fault-injection framework, specifically the failslab feature. The following commands illustrate how to set up fault injection to test the igc_led_setup failure: #!/bin/bash -ex FAILSLAB_PATH=/sys/kernel/debug/failslab/ DEVICE=0000:00:05.0 START_ADDR=$(grep " igc_led_setup" /proc/kallsyms | awk '{printf("0x%s", $1)}') END_ADDR=$(printf "0x%x" $((START_ADDR + 0x100))) echo $START_ADDR > $FAILSLAB_PATH/require-start echo $END_ADDR > $FAILSLAB_PATH/require-end echo 1 > $FAILSLAB_PATH/times echo 100 > $FAILSLAB_PATH/probability echo N > $FAILSLAB_PATH/ignore-gfp-wait echo $DEVICE > /sys/bus/pci/drivers/igc/bind
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, update the Linux kernel to a version where the igc driver treats LED setup failures as non-fatal and continues the probe with a warning instead of failing and causing a kernel panic. This avoids the failure in igc_probe() and prevents the kernel panic triggered by free_netdev().