CVE-2025-38200

What it actually does

Integer underflow in i40e_clear_hw allows MMIO write to an invalid page when the device provides crafted input.

Why it matters to the business

Systems using affected Intel i40e network hardware on Linux kernels face risk of memory corruption that can lead to crashes, denial of service, or local privilege escalation; widespread use in servers and containers increases exposure across many environments.

How an attack unfolds

An attacker with the ability to influence device input (local or via hardware interaction) triggers the underflow during hardware clearing operations, resulting in an out-of-bounds MMIO write that corrupts kernel memory.

How to fix it

Upgrade to a fixed kernel containing commit 872607632c658d3739e4e7889e4f3c419ae2c193 or later; for rancher-api-ui on Chainguard or Wolfi update to 1.2.3-r1.

How to confirm the fix worked

Verify kernel source or package version includes the referenced commit; test i40e driver initialization and hardware reset paths under expected device inputs.

Typical attack path

1. Gain local access or control over i40e device input on a vulnerable kernel
2. Trigger i40e_clear_hw path with crafted device response causing integer underflow
3. Achieve MMIO write to invalid page leading to memory corruption or escalation

How to detect it

Review kernel logs for i40e driver faults or unexpected MMIO errors around device reset events; correlate with threat actor activity involving Linux kernel privilege escalation.

What your security team should do

• Prioritize kernel upgrades on all systems using i40e hardware
• Apply fixed versions immediately where i40e devices are present
• Monitor for related Linux kernel privilege escalation activity