CVE-2025-39969 i40e: fix validation of VF state in get resources
A logic error in the i40e driver's VF state validation could lead to resource allocation issues, potentially causing denial of service.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-39969?
CVE-2025-39969 is a high-severity vulnerability in Linux, published on 15 Oct 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
i40e: fix validation of VF state in get resources
VF state I40E_VF_STATE_ACTIVE is not the only state in which VF is actually active so it should not be used to determine if a VF is allowed to obtain resources.
Use I40E_VF_STATE_RESOURCES_LOADED that is set only in i40e_vc_get_vf_resources_msg() and cleared during reset.
Which versions are affected by CVE-2025-39969?
How do I fix CVE-2025-39969?
Apply the vendor's patch.
Is CVE-2025-39969 being exploited?
There is no known exploitation of CVE-2025-39969 in the wild and no public exploit code.
Sources
Also known as AZL-68489, BELL-CVE-2025-39969, DEBIAN-CVE-2025-39969, GHSA-xxpg-m5qg-jjxh, ROOT-OS-DEBIAN-11-CVE-2025-39969, ROOT-OS-DEBIAN-12-CVE-2025-39969 and 3 more.