CVE-2025-39970

i40e: fix input validation logic for action_meta

State: Published
Severity: 8.8 High
Published: Oct 15, 2025
Updated: Oct 15, 2026
Reserved: Apr 16, 2025

Description

In the Linux kernel, the following vulnerability has been resolved:

i40e: fix input validation logic for action_meta

Fix condition to check 'greater or equal' to prevent OOB dereference.

Scores

CVSS	Score	Vector	Source
3.1	8.8 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	e284fc280473bed23f2e1ed324e102a48f7d17e1 to before a88c1b2746eccf00e2094b187945f0f1e990b400Affected e284fc280473bed23f2e1ed324e102a48f7d17e1 to before 28465770ca3b694286ff9ed6dfd558413f57d98fAffected e284fc280473bed23f2e1ed324e102a48f7d17e1 to before f8c8e11825b24661596fa8db2f0981ba17ed0817Affected e284fc280473bed23f2e1ed324e102a48f7d17e1 to before 461e0917eedcd159d87f3ea846754a1e07d7e78aAffected e284fc280473bed23f2e1ed324e102a48f7d17e1 to before 3883e9702b6a4945e93b16c070f338a9f5b496f9Affected e284fc280473bed23f2e1ed324e102a48f7d17e1 to before 3118f41d8fa57b005f53ec3db2ba5eab1d7ba12bAffected e284fc280473bed23f2e1ed324e102a48f7d17e1 to before 560e1683410585fbd5df847f43433c4296f0d222Affected e284fc280473bed23f2e1ed324e102a48f7d17e1 to before 9739d5830497812b0bdeaee356ddefbe60830b88Affected
LinuxLinux	4.17Affected before 4.17Not affected 5.4.300 through 5.4.Not affected 5.10.245 through 5.10.Not affected 5.15.194 through 5.15.Not affected 6.1.155 through 6.1.Not affected 6.6.109 through 6.6.Not affected 6.12.50 through 6.12.Not affected 6.16.10 through 6.16.*Not affected 6.17 and laterNot affected

Product

Versions

LinuxLinux

e284fc280473bed23f2e1ed324e102a48f7d17e1 to before a88c1b2746eccf00e2094b187945f0f1e990b400Affected
e284fc280473bed23f2e1ed324e102a48f7d17e1 to before 28465770ca3b694286ff9ed6dfd558413f57d98fAffected
e284fc280473bed23f2e1ed324e102a48f7d17e1 to before f8c8e11825b24661596fa8db2f0981ba17ed0817Affected
e284fc280473bed23f2e1ed324e102a48f7d17e1 to before 461e0917eedcd159d87f3ea846754a1e07d7e78aAffected
e284fc280473bed23f2e1ed324e102a48f7d17e1 to before 3883e9702b6a4945e93b16c070f338a9f5b496f9Affected
e284fc280473bed23f2e1ed324e102a48f7d17e1 to before 3118f41d8fa57b005f53ec3db2ba5eab1d7ba12bAffected
e284fc280473bed23f2e1ed324e102a48f7d17e1 to before 560e1683410585fbd5df847f43433c4296f0d222Affected
e284fc280473bed23f2e1ed324e102a48f7d17e1 to before 9739d5830497812b0bdeaee356ddefbe60830b88Affected

LinuxLinux

4.17Affected
before 4.17Not affected
5.4.300 through 5.4.*Not affected
5.10.245 through 5.10.*Not affected
5.15.194 through 5.15.*Not affected
6.1.155 through 6.1.*Not affected
6.6.109 through 6.6.*Not affected
6.12.50 through 6.12.*Not affected
6.16.10 through 6.16.*Not affected
6.17 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.