What’s Vulnerable › Vulnerabilities

CVE-2025-39970: i40e: fix input validation logic for action_meta

• Severity: high (CVSS 8.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-10-15 · updated 2026-10-19

Description

In the Linux kernel, the following vulnerability has been resolved: i40e: fix input validation logic for action_meta Fix condition to check 'greater or equal' to prevent OOB dereference.

Affected products

• Linux kernel: 4.17 — fixed in 6.17

How to fix

Upgrade to a fixed version: Linux kernel 6.17. Check the vendor advisory for mitigations.

References

• https://git.kernel.org/stable/c/28465770ca3b694286ff9ed6dfd558413f57d98f
• https://git.kernel.org/stable/c/3118f41d8fa57b005f53ec3db2ba5eab1d7ba12b
• https://git.kernel.org/stable/c/3883e9702b6a4945e93b16c070f338a9f5b496f9
• https://git.kernel.org/stable/c/461e0917eedcd159d87f3ea846754a1e07d7e78a
• https://git.kernel.org/stable/c/560e1683410585fbd5df847f43433c4296f0d222
• https://git.kernel.org/stable/c/9739d5830497812b0bdeaee356ddefbe60830b88
• https://git.kernel.org/stable/c/a88c1b2746eccf00e2094b187945f0f1e990b400
• https://git.kernel.org/stable/c/f8c8e11825b24661596fa8db2f0981ba17ed0817

Get alerted when CVE-2025-39970 or the next vulnerability affects your stack