CVE-2025-39922 ixgbe: fix incorrect map used in eee linkmode
A memory corruption vulnerability in the ixgbe network driver allows out-of-bounds access, potentially leading to system crashes or arbitrary code execution.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-39922?
CVE-2025-39922 is a high-severity memory corruption vulnerability in Linux kernel, published on 1 Oct 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
ixgbe: fix incorrect map used in eee linkmode
incorrectly used ixgbe_lp_map in loops intended to populate the supported and advertised EEE linkmode bitmaps based on ixgbe_ls_map. This results in incorrect bit setting and potential out-of-bounds access, since ixgbe_lp_map and ixgbe_ls_map have different sizes and purposes.
ixgbe_lp_map[i] -> ixgbe_ls_map[i]
Use ixgbe_ls_map for supported and advertised linkmodes, and keep ixgbe_lp_map usage only for link partner (lp_advertised) mapping.
Weakness: CWE-125
Which versions are affected by CVE-2025-39922?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2025-39922?
Apply the vendor's patch.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2025-39922 being exploited?
There is no known exploitation of CVE-2025-39922 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as BELL-CVE-2025-39922, DEBIAN-CVE-2025-39922, GHSA-vmg3-v8p4-c57v, UBUNTU-CVE-2025-39922.