Linux i40e: unvalidated TC index in a VF config-queues message reads past vf->ch[]

Impact

i40e_vc_config_queues_msg() iterated vf->ch[idx] without checking idx against the number of active or initialized traffic classes, so a virtual function could drive the PF driver to index outside that array using a value it supplies in a virtchnl message. The attacker side here is a VF - a tenant VM or container holding a passed-through i40e virtual function - and the corrupted side is the host PF driver, which is exactly the trust boundary SR-IOV is supposed to hold. On a GPU node, i40e VFs are a common way to give tenants line-rate access to the data network, and a host-side PF driver fault takes the node's networking (and the node) with it. The CVSS vector marks changed scope, consistent with a guest reaching host state.

Who can reach it

A local guest or container that owns an i40e virtual function and can send virtchnl messages to the PF. No host privilege needed; requires that SR-IOV VFs on Intel X710/XL710-class NICs be handed to untrusted tenants.

What to do

Update to a stable kernel carrying the idx range check and reboot each affected node - a driver fix with no runtime toggle, so drain and reboot. Interim mitigation is to stop assigning i40e VFs to untrusted tenants on unpatched hosts.

References

Related entries

• Linux kernel i40e: unvalidated index into vf->ch[] in i40e_validate_queue_mapCVE-2025-39972 · Linux kernel i40e driver (i40e_validate_queue_map TC index)High
• Linux kernel i40e: VF-supplied ring_len written to hardware HMC context without validationCVE-2025-39973 · Linux kernel i40e driver (VF ring_len in HMC context)High
• Linux kernel (drivers/iommu/intel): VT-d advertised IOMMU dirty-page tracking on units whose page walk is not coherentCVE-2025-40058 · Linux kernel (drivers/iommu/intel)High
• Linux kernel (drivers/gpu/drm): The shared GPU SVM layer mis-computes the mapping order when an HMM range onlyCVE-2025-40336 · Linux kernel (drivers/gpu/drm)High
• Linux nvme-fc: unlocked port_state check races remote-port teardown against reconnectCVE-2025-40342 · Linux kernel nvme-fc (unlocked port_state / rport state access)High
• CephFS kernel client (ceph.ko, MDS auth caps): In a multi-FS Ceph cluster the kernel client applies an MDS auth capCVE-2025-40362 · CephFS kernel client (ceph.ko, MDS auth caps)High