CVE-2025-39897

What it actually does

Missing error handling on RX metadata pointer retrieval in the Xilinx AXI Ethernet driver allows use of an invalid pointer.

Why it matters to the business

Affected Linux systems may experience network driver instability or crashes under specific traffic conditions, with low but non-zero exploitation likelihood.

How an attack unfolds

An attacker sends crafted network traffic to an affected interface to induce failure during RX metadata pointer retrieval, causing the driver to operate on an unvalidated pointer.

How to fix it

Apply the kernel commit d0ecda6fdd840b406df6617b003b036f65dd8926 or update python-Django on SUSE Enterprise Storage 4 to version 1.6.11-5.5.1.

How to confirm the fix worked

Confirm presence of the error-handling patch in the axienet driver source and verify the fixed commit or package version is installed.

Typical attack path

1. Identify systems exposing Xilinx AXI Ethernet interfaces
2. Send specially formed packets to trigger RX metadata path
3. Trigger missing error handling to dereference invalid pointer
4. Observe resulting kernel fault or denial of service

How to detect it

Review kernel logs for axienet-related faults or pointer errors around network receive paths; correlate with unusual traffic patterns on Xilinx Ethernet interfaces.

What your security team should do

• Prioritize patching kernel packages containing the axienet driver on all affected hosts
• Monitor EPSS trend for any increase indicating rising exploit availability
• Apply vendor updates within normal change windows given absence from KEV