Linux kernel i40e: wrong dev_id in free_irq() leaves IRQs un-freed on the MSI-X error path

Impact

If request_irq() fails on a later iteration in i40e_vsi_request_irq_msix(), the unwind calls free_irq() with the wrong dev_id, so the already-requested IRQs are not released and the kernel warns "Trying to free already-free IRQ". Intel X710/XL710 NICs are common management and storage NICs on GPU hosts; the path runs when bringing an interface up, so the realistic consequence is a leaked IRQ and an inconsistent interface state after a failed ip link set up, not a tenant-controlled memory primitive. The reporter reached it only by injecting failures. Worth taking with the rest of your stable kernel updates rather than on its own window.

Who can reach it

Local and privileged: requires bringing up an i40e interface (root / NET_ADMIN) and an interrupt-request failure part way through setup. No tenant or remote path.

What to do

Fold the stable kernel fix (five backports linked) into your next kernel update and reboot the node; nothing to do at runtime. Low urgency relative to the other kernel items in the same batch. No fixed version string in the record.

References

Related entries

• Linux kernel BPF: missing destination length check in bpf_crypto_crypt allows out-of-bounds writeCVE-2025-39917 · Linux kernel BPF (bpf_crypto_crypt dynptr length check)High
• Linux kernel io_uring: io_link_skb compares a notification against itself, skipping the context validation checkCVE-2025-39963 · Linux kernel io_uring zero-copy send (io_link_skb notification context check)High
• Linux kernel (net/xfrm): SPI 0 means 'no SPI assigned', but the duplicate-SPI rework started creating states with SPI 0CVE-2025-39965 · Linux kernel (net/xfrm)High
• Linux kernel (drivers/iommu/iommufd): Aborting an iommufd object allocation freed the object immediately while theCVE-2025-39966 · Linux kernel (drivers/iommu/iommufd)High
• Linux kernel mlx5_core flow steering / flow counters (hardware steering): Use-after-free releasingCVE-2025-39979 · Linux kernel mlx5_core flow steering / flow counters (hardware steering)High
• Linux kernel BPF verifier: get_helper_proto dereferences a NULL helper function pointer when a config option is disabledCVE-2025-39990 · Linux kernel BPF verifier (get_helper_proto NULL helper pointer)High