{"id":"CVE-2025-39973","revision":"2c9a920712c7423fb6a678b07d593ff6","records":[{"revision":"2c9a920712c7423fb6a678b07d593ff6","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2025-39973","aliases":[],"title":"i40e: add validation for ring_len param","description":"In the Linux kernel, the following vulnerability has been resolved:\n\ni40e: add validation for ring_len param\n\nThe `ring_len` parameter provided by the virtual function (VF)\nis assigned directly to the hardware memory context (HMC) without\nany validation.\n\nTo address this, introduce an upper boundary check for both Tx and Rx\nqueue lengths. The maximum number of descriptors supported by the\nhardware is 8k-32.\nAdditionally, enforce alignment constraints: Tx rings must be a multiple\nof 8, and Rx rings must be a multiple of 32.","state":0,"publishedAt":"2025-10-15T07:55:55.59+00:00","modifiedAt":"2026-10-15T22:02:34.963+00:00","affected":[{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"5c3c48ac6bf56367c4e89f6453cd2d61e50375bd\",\n                            \"lessThan\": \"0543d40d6513cdf1c7882811086e59a6455dfe97\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"5c3c48ac6bf56367c4e89f6453cd2d61e50375bd\",\n                            \"lessThan\": \"7d749e38dd2b7e8a80da2ca30c93e09de95bfcf9\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"5c3c48ac6bf56367c4e89f6453cd2d61e50375bd\",\n                            \"lessThan\": \"45a7527cd7da4cdcf3b06b5c0cb1cae30b5a5985\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"5c3c48ac6bf56367c4e89f6453cd2d61e50375bd\",\n                            \"lessThan\": \"d3b0d3f8d11fa957171fbb186e53998361a88d4e\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"5c3c48ac6bf56367c4e89f6453cd2d61e50375bd\",\n                            \"lessThan\": \"c0c83f4cd074b75cecef107bfc349be7d516c9c4\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"5c3c48ac6bf56367c4e89f6453cd2d61e50375bd\",\n                            \"lessThan\": \"05fe81fb9db20464fa532a3835dc8300d68a2f84\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"5c3c48ac6bf56367c4e89f6453cd2d61e50375bd\",\n                            \"lessThan\": \"afec12adab55d10708179a64d95d650741e60fe0\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"5c3c48ac6bf56367c4e89f6453cd2d61e50375bd\",\n                            \"lessThan\": \"55d225670def06b01af2e7a5e0446fbe946289e8\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"affected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"3.12\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"0\",\n                            \"lessThan\": \"3.12\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"5.4.300\",\n                            \"lessThanOrEqual\": \"5.4.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"5.10.245\",\n                            \"lessThanOrEqual\": \"5.10.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"5.15.194\",\n                            \"lessThanOrEqual\": \"5.15.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.1.155\",\n                            \"lessThanOrEqual\": \"6.1.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.6.109\",\n                            \"lessThanOrEqual\": \"6.6.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.12.50\",\n                            \"lessThanOrEqual\": \"6.12.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.16.10\",\n                            \"lessThanOrEqual\": \"6.16.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.17\",\n                            \"lessThanOrEqual\": \"*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"original_commit_for_fix\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","score":8.8,"severity":"HIGH"}],"references":["https://git.kernel.org/stable/c/0543d40d6513cdf1c7882811086e59a6455dfe97","https://git.kernel.org/stable/c/7d749e38dd2b7e8a80da2ca30c93e09de95bfcf9","https://git.kernel.org/stable/c/45a7527cd7da4cdcf3b06b5c0cb1cae30b5a5985","https://git.kernel.org/stable/c/d3b0d3f8d11fa957171fbb186e53998361a88d4e","https://git.kernel.org/stable/c/c0c83f4cd074b75cecef107bfc349be7d516c9c4","https://git.kernel.org/stable/c/05fe81fb9db20464fa532a3835dc8300d68a2f84","https://git.kernel.org/stable/c/afec12adab55d10708179a64d95d650741e60fe0","https://git.kernel.org/stable/c/55d225670def06b01af2e7a5e0446fbe946289e8"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2025-39973","license":"CVE Program Terms of Use","key":"cve-program:CVE-2025-39973","identifiers":["CVE-2025-39973"]},"retained":false,"historicalAffected":[]}],"coverage":[]}