Database/Kernel, userspace & hypervisor
Linux kernel i40e: VF-supplied ring_len written to hardware HMC context without validation
Impact
The ring_len a virtual function asks for was programmed straight into the hardware memory context with no upper bound and no alignment check; the fix caps Tx and Rx descriptor counts at the hardware maximum of 8k-32 and enforces the 8- and 32-descriptor alignment the hardware requires. A tenant VF can therefore put the NIC into a state the hardware does not define, which is reached through the host PF driver and recorded with a changed scope. On a GPU node where the data-plane NIC is shared by SR-IOV, that means one tenant can break host networking - and a NIC wedged at the hardware-context level typically needs a reboot, not a driver reload. Distinct from the other two i40e VF-validation CVEs in the same series: different field, different check.
Who can reach it
Local to the guest: any tenant that owns an i40e VF and can request ring sizes from the PF. No host credentials.
What to do
Move to a stable kernel with the linked fix and reboot the node. No configuration workaround exists; the interim mitigation is to withhold i40e VFs from untrusted tenants. Drain the node before rebooting.
References
Related entries
- Linux kernel (drivers/iommu/intel): VT-d advertised IOMMU dirty-page tracking on units whose page walk is not coherentCVE-2025-40058 · Linux kernel (drivers/iommu/intel)High
- Linux kernel (drivers/gpu/drm): The shared GPU SVM layer mis-computes the mapping order when an HMM range onlyCVE-2025-40336 · Linux kernel (drivers/gpu/drm)High
- Linux nvme-fc: unlocked port_state check races remote-port teardown against reconnectCVE-2025-40342 · Linux kernel nvme-fc (unlocked port_state / rport state access)High
- CephFS kernel client (ceph.ko, MDS auth caps): In a multi-FS Ceph cluster the kernel client applies an MDS auth capCVE-2025-40362 · CephFS kernel client (ceph.ko, MDS auth caps)High
- libssh: failed key derivation returns success, leaving SSH sessions keyed with uninitialized memoryCVE-2025-5372 · libssh (ssh_kdf key derivation, builds against OpenSSL older than 3.0)High
- AMD Pensando ionic cloud driver for VMware ESXi (heap overflow): Second heap overflow in the ionic ESXi driverCVE-2025-62623 · AMD Pensando ionic cloud driver for VMware ESXi (heap overflow)High
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.