The Linux kernel i40e driver lacked a maximum boundary check on the number of filters that a Virtual Function (VF) could request. This absence of validation could allow a VF to request an excessive number of filters, potentially leading to denial of service or other impacts. The vulnerability has been resolved by adding the necessary boundary check to limit the number of VF filters. The CVSS 3.1 vector indicates local attack vector, low attack complexity, low privileges required, no user interaction, scope change, no confidentiality impact, limited integrity impact, and high availability impact.

The vulnerability allows a local attacker with low privileges to request an unlimited number of VF filters, which can lead to a denial of service condition affecting system availability. There is no confidentiality impact, and the integrity impact is limited. The scope of the vulnerability is changed, indicating that the vulnerability affects resources beyond the initially vulnerable component.

A fix has been implemented in the Linux kernel by adding a maximum boundary check for VF filters in the i40e driver. Users and administrators should apply the official Linux kernel updates that include this fix once available. Patch status is not yet confirmed in this data; check the vendor or Linux kernel advisories for current remediation guidance.