Linux i40e: empty MAC filter list dereferences an invalid list entry

Impact

The i40e driver used list_first_entry() on the VSI MAC filter list, which never returns NULL - on an empty list it yields a pointer into the list head, and dereferencing it reads memory that is not a MAC filter. On a GPU node this is a host-kernel memory-safety bug in the driver for the Intel 700-series NICs commonly used for management and storage networking, and the CVSS vector records high confidentiality and availability impact for a local low-privileged user. A crash here takes the whole node down, including every GPU workload on it, and a node that panics mid-job has to be rescheduled and drained. The record does not describe a working exploit or privilege escalation, only the invalid access.

Who can reach it

Local, authenticated low-privileged access on the host (per the CVSS vector AV:L/PR:L). Reaching it requires driving the i40e MAC filter paths while the filter list is empty; the record gives no remote or tenant-visible path.

What to do

Pick up a stable kernel containing the fix (list_first_entry_or_null); five stable branches carry it, see the git.kernel.org commits. Applying it means a kernel update and a reboot of each affected node, so drain GPU jobs first. Siemens RUGGEDCOM and SCALANCE switch firmware is listed as affected downstream and would need a vendor firmware update instead; no fixed version is stated in the record.

References

Related entries

• Linux kernel i40e: out-of-bounds read through the netdev_ops debugfs fileCVE-2025-39901 · Linux kernel i40e driver (netdev_ops debugfs file)High
• Linux kernel (arch/x86/kvm/svm): On AMD hosts that cannot report the next RIP, KVM's WRMSR/HLT/INVD fastpath has toCVE-2025-40038 · Linux kernel (arch/x86/kvm/svm)High
• VMware ESXi / Workstation / Tools: Uninitialised memory in vSockets discloses host memory to the guestCVE-2025-41239 · VMware ESXi / Workstation / ToolsHigh
• Linux crypto/iaa: out-of-bounds compression-mode index when no slot is freeCVE-2025-71231 · Linux kernel crypto/iaa driver (Intel In-Memory Analytics Accelerator compression modes)High
• Firecracker: failed memory remap lets a guest root user read or modify VMM process memoryCVE-2026-122192 · Firecracker VMM (balloon / virtio-mem discard on File-backend snapshot restore)High
• PackageKit dnf5 backend: an unprivileged local user can uninstall packages under a simulate flagCVE-2026-19816 · PackageKit dnf5 backend (RepoRemove polkit bypass)High