The Linux kernel i40e driver contained a vulnerability (CVE-2025-39971) due to improper validation of an index parameter in the config queues message function (i40e_vc_config_queues_msg). The fix ensures that the index is checked to be within the valid range of active or initialized traffic classes before accessing the vf->ch array. This prevents potential out-of-bounds access that could lead to confidentiality, integrity, and availability impacts. The vulnerability is rated high severity with CVSS 3.1 vector AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. No patch links or affected versions were explicitly provided in the data.

If exploited, this vulnerability could allow an attacker with local access and low privileges to cause a complete compromise of confidentiality, integrity, and availability of the affected system due to improper index validation leading to out-of-bounds memory access. However, no known exploits are reported in the wild at this time.

A fix for this vulnerability has been implemented in the Linux kernel i40e driver. Since no explicit patch link or version information is provided, users should apply the latest Linux kernel updates from their distribution or vendor to ensure the vulnerability is addressed. Patch status is not yet confirmed — check the vendor advisory or Linux kernel release notes for current remediation guidance.