CVE-2025-39969
BaseFortify
Publication date: 2025-10-15
Last updated on: 2025-10-16
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| intel | linux_kernel | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-UNKNOWN |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability in the Linux kernel's i40e driver involves improper validation of the Virtual Function (VF) state when obtaining resources. The driver incorrectly uses the VF state I40E_VF_STATE_ACTIVE to determine if a VF is allowed to obtain resources, but this state does not cover all cases where a VF is active. The correct state to check is I40E_VF_STATE_RESOURCES_LOADED, which is set only when resources are properly allocated and cleared during reset. This fix ensures that resource allocation checks are accurate.
How can this vulnerability impact me? :
If exploited, this vulnerability could allow a Virtual Function (VF) to obtain resources improperly because the driver does not correctly validate the VF's active state. This could lead to resource misallocation or instability in the network device's operation, potentially affecting system reliability or performance.