Database/Kernel, userspace & hypervisor
Linux kernel i40e: unvalidated index into vf->ch[] in i40e_validate_queue_map
Impact
i40e_validate_queue_map() iterated vf->ch[idx] without checking idx against the number of active or initialized traffic classes, so a VF-supplied queue map walks past the channel array in the host PF driver. As with the other i40e VF-input fixes in this series, the recorded scope change points at an SR-IOV guest reaching host kernel state. On a multi-tenant GPU node with i40e VFs passed into tenant VMs, one tenant can corrupt or crash the host networking stack and with it every job on the box. This is a separate code path and a separate fix from CVE-2025-39970 and CVE-2025-39973 even though the three landed together.
Who can reach it
Local to the guest: a tenant holding an i40e VF that can send a crafted queue-map configuration to the PF. No host authentication required.
What to do
Update to a stable kernel carrying the linked fix and reboot the node; the i40e PF driver cannot be meaningfully reloaded under live VFs. Until then, the mitigation is not assigning i40e VFs to untrusted workloads. Drain GPU jobs before the reboot.
References
Related entries
- Linux kernel i40e: VF-supplied ring_len written to hardware HMC context without validationCVE-2025-39973 · Linux kernel i40e driver (VF ring_len in HMC context)High
- Linux kernel (drivers/iommu/intel): VT-d advertised IOMMU dirty-page tracking on units whose page walk is not coherentCVE-2025-40058 · Linux kernel (drivers/iommu/intel)High
- Linux kernel (drivers/gpu/drm): The shared GPU SVM layer mis-computes the mapping order when an HMM range onlyCVE-2025-40336 · Linux kernel (drivers/gpu/drm)High
- Linux nvme-fc: unlocked port_state check races remote-port teardown against reconnectCVE-2025-40342 · Linux kernel nvme-fc (unlocked port_state / rport state access)High
- CephFS kernel client (ceph.ko, MDS auth caps): In a multi-FS Ceph cluster the kernel client applies an MDS auth capCVE-2025-40362 · CephFS kernel client (ceph.ko, MDS auth caps)High
- libssh: failed key derivation returns success, leaving SSH sessions keyed with uninitialized memoryCVE-2025-5372 · libssh (ssh_kdf key derivation, builds against OpenSSL older than 3.0)High
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.