CVE-2025-39972

What it actually does

Missing bounds check on traffic class index allows out-of-bounds access into vf->ch[] array during queue map validation in the i40e driver.

Why it matters to the business

Local attackers can trigger kernel memory corruption, leading to crashes, denial of service, or potential privilege escalation on affected systems; high prevalence in Linux environments increases exposure for servers and virtualized workloads.

How an attack unfolds

An attacker with local access configures a VF with an invalid traffic class index, then triggers i40e_validate_queue_map() which iterates without verifying the index is within the range of active TCs, resulting in invalid memory dereference.

How to fix it

Update the Linux kernel to commit b6cb93a7ff208f324c7ec581d72995f80e115e0e or later; for SUSE Linux Enterprise Module for Server Applications 15 apply the fixed ovmf package version 2017+git1510945757.b2662641d5-5.3.6 or newer.

How to confirm the fix worked

Confirm kernel source contains the bounds check on idx against active TCs in i40e_validate_queue_map(); test with valid and out-of-range TC indices on VFs; verify no crash or corruption occurs.

Typical attack path

1. Obtain local access on a system using the i40e driver
2. Create or modify a VF with crafted traffic class configuration
3. Invoke queue map validation path in the driver
4. Trigger out-of-bounds access leading to kernel panic or corruption

How to detect it

Review kernel logs for i40e driver oops or invalid memory access traces around VF queue map operations; correlate with recent VF configuration changes.

What your security team should do

• Apply the kernel fix immediately on all systems using i40e NICs
• Prioritize patching servers exposed to untrusted local users or containers
• Monitor for related kernel oops or crashes in i40e driver paths
• Review VF configuration scripts for safe TC index usage