Linux kernel i40e: out-of-bounds read through the netdev_ops debugfs file

Impact

The i40e driver's 'netdev_ops' debugfs file uses a module-wide 256-byte static buffer and formats its read output with snprintf, so a carefully sized write followed by a read can make copy_to_user walk past the end of the kzalloc'd buffer and return adjacent kernel memory. The same shared buffer is written without locking, so concurrent writes against different i40e ports corrupt each other. Real exposure is narrow: debugfs is normally mounted root-only, so on a headless GPU node with no unprivileged debugfs access this is not reachable by a tenant, and the fix removes read access to the file entirely rather than repairing the format. Treat it as hygiene on hosts using Intel 700-series NICs for management or storage networks, not as a tenant-escape path.

Who can reach it

Local user with read and write access to /sys/kernel/debug/driver/i40e — in a stock configuration that means root on the host. No remote or in-guest path.

What to do

Pick up the fix in your distribution's stable kernel and reboot each affected node; the patch is upstream across several stable branches (commits linked). Because exploitation needs debugfs access that is already root-only, this can ride the next scheduled kernel maintenance window rather than an emergency drain — verify debugfs is not mounted world-readable in the meantime.

References