CVE-2025-39853

i40e: Fix potential invalid access when MAC list is empty

State: Published
Severity: Not scored
Published: Sep 19, 2025
Updated: May 12, 2026
Reserved: Apr 16, 2025

Description

In the Linux kernel, the following vulnerability has been resolved:

i40e: Fix potential invalid access when MAC list is empty

list_first_entry() never returns NULL - if the list is empty, it still returns a pointer to an invalid object, leading to potential invalid memory access when dereferenced.

Fix this by using list_first_entry_or_null instead of list_first_entry.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	e3219ce6a775468368fb270fae3eb82a6787b436 to before 971feafe157afac443027acdc235badc6838560bAffected e3219ce6a775468368fb270fae3eb82a6787b436 to before 3c6fb929afa313d9d11f780451d113f73922fe5dAffected e3219ce6a775468368fb270fae3eb82a6787b436 to before 1eadabcf5623f1237a539b16586b4ed8ac8dffcdAffected e3219ce6a775468368fb270fae3eb82a6787b436 to before e2a5e74879f9b494bbd66fa93f355feacde450c7Affected e3219ce6a775468368fb270fae3eb82a6787b436 to before fb216d980fae6561c7c70af8ef826faf059c6515Affected e3219ce6a775468368fb270fae3eb82a6787b436 to before 66e7cdbda74ee823ec2bf7b830ebd235c54f5ddfAffected e3219ce6a775468368fb270fae3eb82a6787b436 to before 9c21fc4cebd44dd21016c61261a683af390343f8Affected e3219ce6a775468368fb270fae3eb82a6787b436 to before a556f06338e1d5a85af0e32ecb46e365547f92b9Affected
LinuxLinux	4.6Affected before 4.6Not affected 5.4.299 through 5.4.Not affected 5.10.243 through 5.10.Not affected 5.15.192 through 5.15.Not affected 6.1.151 through 6.1.Not affected 6.6.105 through 6.6.Not affected 6.12.46 through 6.12.Not affected 6.16.6 through 6.16.*Not affected 6.17 and laterNot affected

Product

Versions

LinuxLinux

e3219ce6a775468368fb270fae3eb82a6787b436 to before 971feafe157afac443027acdc235badc6838560bAffected
e3219ce6a775468368fb270fae3eb82a6787b436 to before 3c6fb929afa313d9d11f780451d113f73922fe5dAffected
e3219ce6a775468368fb270fae3eb82a6787b436 to before 1eadabcf5623f1237a539b16586b4ed8ac8dffcdAffected
e3219ce6a775468368fb270fae3eb82a6787b436 to before e2a5e74879f9b494bbd66fa93f355feacde450c7Affected
e3219ce6a775468368fb270fae3eb82a6787b436 to before fb216d980fae6561c7c70af8ef826faf059c6515Affected
e3219ce6a775468368fb270fae3eb82a6787b436 to before 66e7cdbda74ee823ec2bf7b830ebd235c54f5ddfAffected
e3219ce6a775468368fb270fae3eb82a6787b436 to before 9c21fc4cebd44dd21016c61261a683af390343f8Affected
e3219ce6a775468368fb270fae3eb82a6787b436 to before a556f06338e1d5a85af0e32ecb46e365547f92b9Affected

LinuxLinux

4.6Affected
before 4.6Not affected
5.4.299 through 5.4.*Not affected
5.10.243 through 5.10.*Not affected
5.15.192 through 5.15.*Not affected
6.1.151 through 6.1.*Not affected
6.6.105 through 6.6.*Not affected
6.12.46 through 6.12.*Not affected
6.16.6 through 6.16.*Not affected
6.17 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.