CVE-2025-39853

What it actually does

In the i40e driver, list_first_entry on an empty MAC list returns an invalid pointer that is dereferenced, resulting in invalid memory access.

Why it matters to the business

Systems using affected Linux kernel versions with i40e network hardware face elevated risk of crashes, memory corruption, or local information disclosure; widespread kernel usage increases operational exposure across server and container fleets.

How an attack unfolds

A local attacker with low privileges manipulates network configuration to produce an empty MAC list, then triggers the vulnerable list traversal path in the i40e driver, causing the kernel to dereference an invalid pointer.

How to fix it

Upgrade the Linux kernel to a version containing commit 971feafe157afac443027acdc235badc6838560b or later; apply the equivalent stable backport that replaces list_first_entry with list_first_entry_or_null in the i40e MAC list handling code.

How to confirm the fix worked

Confirm the patched source contains list_first_entry_or_null usage in the i40e driver; verify the running kernel version matches or exceeds the fixed commit; test that empty MAC list scenarios no longer produce invalid pointer dereferences.

Typical attack path

1. Obtain local shell or container access on a system with i40e hardware
2. Configure network interfaces to leave the MAC address list empty
3. Invoke the driver code path that calls list_first_entry without prior emptiness check
4. Trigger dereference of the invalid pointer returned by list_first_entry

How to detect it

Review kernel logs for i40e driver oops or invalid pointer dereference messages around network configuration changes; inspect audit logs for unusual local interface modifications preceding crashes.

What your security team should do

• Prioritize kernel updates on all systems exposing i40e interfaces within the next patching cycle
• Restrict local unprivileged access on hosts with i40e hardware until patches are deployed
• Monitor EPSS trend and any new threat actor mentions for changes in exploit availability