{"id":"CVE-2025-39969","title":"i40e: fix validation of VF state in get resources","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\ni40e: fix validation of VF state in get resources\n\nVF state I40E_VF_STATE_ACTIVE is not the only state in which\nVF is actually active so it should not be used to determ…","severity":"high","cvss":8.8,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","cvssSource":"cna","vendor":"Linux","product":"Linux","affected":["Linux >= 171527da84149c2c7aa6a60a64b09d24f3546298 < 185745d56ec958bf8aa773828213237dfcc32f5a","Linux >= eb87117c27e729b0aeef4d72ed40d6a1761b0f68 < f47876788a23de296c42ef9d505b5c1630f0b4b8","Linux >= 2132643b956f553f5abddc9bae20dae267b082e0 < 8e35c80f8570426fe0f0cc92b151ebd835975f22","Linux >= 61125b8be85dfbc7e9c7fe1cc6c6d631ab603516 < 6c3981fd59ef11a75005ac9978f034da5a168b6a","Linux >= 61125b8be85dfbc7e9c7fe1cc6c6d631ab603516 < e748f1ee493f88e38b77363a60499f979d42c58a","Linux >= 61125b8be85dfbc7e9c7fe1cc6c6d631ab603516 < 6128bbc7adc25c87c2f64b5eb66a280b78ef7ab7","Linux >= 61125b8be85dfbc7e9c7fe1cc6c6d631ab603516 < a991dc56d3e9a2c3db87d0c3f03c24f6595400f1","Linux >= 61125b8be85dfbc7e9c7fe1cc6c6d631ab603516 < 877b7e6ffc23766448236e8732254534c518ba42","Linux >= 5.4.165 < 5.4.300","Linux >= 5.10.85 < 5.10.245","Linux >= 5.15.8 < 5.15.194","Linux 5.16"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total","timestamp":"2026-10-15T21:55:24.332500Z"},"published":"2025-10-15","updated":"2026-10-15","sourceUpdated":"2026-10-15T22:02:34.578Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2025-39969","references":[{"url":"https://git.kernel.org/stable/c/185745d56ec958bf8aa773828213237dfcc32f5a"},{"url":"https://git.kernel.org/stable/c/f47876788a23de296c42ef9d505b5c1630f0b4b8"},{"url":"https://git.kernel.org/stable/c/8e35c80f8570426fe0f0cc92b151ebd835975f22"},{"url":"https://git.kernel.org/stable/c/6c3981fd59ef11a75005ac9978f034da5a168b6a"},{"url":"https://git.kernel.org/stable/c/e748f1ee493f88e38b77363a60499f979d42c58a"},{"url":"https://git.kernel.org/stable/c/6128bbc7adc25c87c2f64b5eb66a280b78ef7ab7"},{"url":"https://git.kernel.org/stable/c/a991dc56d3e9a2c3db87d0c3f03c24f6595400f1"},{"url":"https://git.kernel.org/stable/c/877b7e6ffc23766448236e8732254534c518ba42"}],"tags":["cve.org"],"epss":0.00154,"epssPercentile":0.04522,"ingestedAt":"2026-10-15T22:48:25.534Z","slug":"CVE-2025-39969","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ni40e: fix validation of VF state in get resources\n\nVF state I40E_VF_STATE_ACTIVE is not the only state in which\nVF is actually active so it should not be used to determine\nif a VF is allowed to obtain resources.\n\nUse I40E_VF_STATE_RESOURCES_LOADED that is set only in\ni40e_vc_get_vf_resources_msg() and cleared during reset.\n\n## Affected\n\n- `Linux >= 171527da84149c2c7aa6a60a64b09d24f3546298 < 185745d56ec958bf8aa773828213237dfcc32f5a`\n- `Linux >= eb87117c27e729b0aeef4d72ed40d6a1761b0f68 < f47876788a23de296c42ef9d505b5c1630f0b4b8`\n- `Linux >= 2132643b956f553f5abddc9bae20dae267b082e0 < 8e35c80f8570426fe0f0cc92b151ebd835975f22`\n- `Linux >= 61125b8be85dfbc7e9c7fe1cc6c6d631ab603516 < 6c3981fd59ef11a75005ac9978f034da5a168b6a`\n- `Linux >= 61125b8be85dfbc7e9c7fe1cc6c6d631ab603516 < e748f1ee493f88e38b77363a60499f979d42c58a`\n- `Linux >= 61125b8be85dfbc7e9c7fe1cc6c6d631ab603516 < 6128bbc7adc25c87c2f64b5eb66a280b78ef7ab7`\n- `Linux >= 61125b8be85dfbc7e9c7fe1cc6c6d631ab603516 < a991dc56d3e9a2c3db87d0c3f03c24f6595400f1`\n- `Linux >= 61125b8be85dfbc7e9c7fe1cc6c6d631ab603516 < 877b7e6ffc23766448236e8732254534c518ba42`\n- `Linux >= 5.4.165 < 5.4.300`\n- `Linux >= 5.10.85 < 5.10.245`\n- `Linux >= 5.15.8 < 5.15.194`\n- `Linux 5.16`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":48,"depthScoreParts":{"impact":48.4,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}