In the Linux kernel, the following vulnerability has been resolved: i40e: add validation for ring_len param The ring_len parameter provided by the… (CVE-2025-39973)
In the Linux kernel, the following vulnerability has been resolved: i40e: add validation for ring_len param The `ring_len` parameter provided by the virtual function (VF) is assigned directly to the hardware memory context (HMC) without any validation. To address this, introduce an upper boundary check for both Tx and Rx queue lengths. The maximum number of descriptors supported by the hardware is 8k-32. Additionally, enforce alignment constraints: Tx rings must be a multiple of 8, and Rx rings must be a multiple of 32.
AI Analysis
Technical Summary
The Linux kernel i40e driver had a vulnerability (CVE-2025-39973) where the ring_len parameter from virtual functions was assigned to hardware memory context without validation. This could lead to improper configuration of Tx and Rx queues. The fix introduced upper boundary checks limiting queue lengths to a maximum supported by hardware (8k-32 descriptors) and enforced alignment constraints (Tx rings multiple of 8, Rx rings multiple of 32). This prevents potential corruption or instability caused by invalid queue sizes.
Potential Impact
The vulnerability allows a local attacker with limited privileges to provide invalid ring_len values, potentially causing corruption or instability in the hardware memory context. The CVSS vector indicates high impact on confidentiality, integrity, and availability, suggesting that exploitation could lead to significant system compromise or denial of service.
Mitigation Recommendations
A fix has been implemented in the Linux kernel i40e driver to validate the ring_len parameter, including upper boundary checks and alignment enforcement. Users should update to the fixed kernel version once available. Patch status is not yet confirmed in this data; check the official Linux kernel advisories for the specific fixed version and apply updates accordingly.
In the Linux kernel, the following vulnerability has been resolved: i40e: add validation for ring_len param The ring_len parameter provided by the… (CVE-2025-39973)
Description
In the Linux kernel, the following vulnerability has been resolved: i40e: add validation for ring_len param The `ring_len` parameter provided by the virtual function (VF) is assigned directly to the hardware memory context (HMC) without any validation. To address this, introduce an upper boundary check for both Tx and Rx queue lengths. The maximum number of descriptors supported by the hardware is 8k-32. Additionally, enforce alignment constraints: Tx rings must be a multiple of 8, and Rx rings must be a multiple of 32.
CVSS v3.1
Score 8.8high
Affected software
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The Linux kernel i40e driver had a vulnerability (CVE-2025-39973) where the ring_len parameter from virtual functions was assigned to hardware memory context without validation. This could lead to improper configuration of Tx and Rx queues. The fix introduced upper boundary checks limiting queue lengths to a maximum supported by hardware (8k-32 descriptors) and enforced alignment constraints (Tx rings multiple of 8, Rx rings multiple of 32). This prevents potential corruption or instability caused by invalid queue sizes.
Potential Impact
The vulnerability allows a local attacker with limited privileges to provide invalid ring_len values, potentially causing corruption or instability in the hardware memory context. The CVSS vector indicates high impact on confidentiality, integrity, and availability, suggesting that exploitation could lead to significant system compromise or denial of service.
Mitigation Recommendations
A fix has been implemented in the Linux kernel i40e driver to validate the ring_len parameter, including upper boundary checks and alignment enforcement. Users should update to the fixed kernel version once available. Patch status is not yet confirmed in this data; check the official Linux kernel advisories for the specific fixed version and apply updates accordingly.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-j9g6-49hr-w92p
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2025-39973"]
- Database Specific Severity
- HIGH
- Cvss Version
- 3.1
Threat ID: 6a6b72d79c2644c7f847bb43
Added to database: 07/30/2026, 15:50:47 UTC
Last enriched: 07/30/2026, 15:54:56 UTC
Last updated: 09/10/2026, 19:36:50 UTC
Views: 21
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.