{"id":"CVE-2025-39970","title":"i40e: fix input validation logic for action_meta","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\ni40e: fix input validation logic for action_meta\n\nFix condition to check 'greater or equal' to prevent OOB dereference.","severity":"high","cvss":8.8,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","cvssSource":"cna","vendor":"Linux","product":"Linux","affected":["Linux >= e284fc280473bed23f2e1ed324e102a48f7d17e1 < a88c1b2746eccf00e2094b187945f0f1e990b400","Linux >= e284fc280473bed23f2e1ed324e102a48f7d17e1 < 28465770ca3b694286ff9ed6dfd558413f57d98f","Linux >= e284fc280473bed23f2e1ed324e102a48f7d17e1 < f8c8e11825b24661596fa8db2f0981ba17ed0817","Linux >= e284fc280473bed23f2e1ed324e102a48f7d17e1 < 461e0917eedcd159d87f3ea846754a1e07d7e78a","Linux >= e284fc280473bed23f2e1ed324e102a48f7d17e1 < 3883e9702b6a4945e93b16c070f338a9f5b496f9","Linux >= e284fc280473bed23f2e1ed324e102a48f7d17e1 < 3118f41d8fa57b005f53ec3db2ba5eab1d7ba12b","Linux >= e284fc280473bed23f2e1ed324e102a48f7d17e1 < 560e1683410585fbd5df847f43433c4296f0d222","Linux >= e284fc280473bed23f2e1ed324e102a48f7d17e1 < 9739d5830497812b0bdeaee356ddefbe60830b88","Linux 4.17"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total","timestamp":"2026-10-15T21:55:27.622516Z"},"published":"2025-10-15","updated":"2026-10-15","sourceUpdated":"2026-10-15T22:02:34.702Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2025-39970","references":[{"url":"https://git.kernel.org/stable/c/a88c1b2746eccf00e2094b187945f0f1e990b400"},{"url":"https://git.kernel.org/stable/c/28465770ca3b694286ff9ed6dfd558413f57d98f"},{"url":"https://git.kernel.org/stable/c/f8c8e11825b24661596fa8db2f0981ba17ed0817"},{"url":"https://git.kernel.org/stable/c/461e0917eedcd159d87f3ea846754a1e07d7e78a"},{"url":"https://git.kernel.org/stable/c/3883e9702b6a4945e93b16c070f338a9f5b496f9"},{"url":"https://git.kernel.org/stable/c/3118f41d8fa57b005f53ec3db2ba5eab1d7ba12b"},{"url":"https://git.kernel.org/stable/c/560e1683410585fbd5df847f43433c4296f0d222"},{"url":"https://git.kernel.org/stable/c/9739d5830497812b0bdeaee356ddefbe60830b88"}],"tags":["cve.org"],"epss":0.00154,"epssPercentile":0.04522,"ingestedAt":"2026-10-15T22:48:25.533Z","slug":"CVE-2025-39970","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ni40e: fix input validation logic for action_meta\n\nFix condition to check 'greater or equal' to prevent OOB dereference.\n\n## Affected\n\n- `Linux >= e284fc280473bed23f2e1ed324e102a48f7d17e1 < a88c1b2746eccf00e2094b187945f0f1e990b400`\n- `Linux >= e284fc280473bed23f2e1ed324e102a48f7d17e1 < 28465770ca3b694286ff9ed6dfd558413f57d98f`\n- `Linux >= e284fc280473bed23f2e1ed324e102a48f7d17e1 < f8c8e11825b24661596fa8db2f0981ba17ed0817`\n- `Linux >= e284fc280473bed23f2e1ed324e102a48f7d17e1 < 461e0917eedcd159d87f3ea846754a1e07d7e78a`\n- `Linux >= e284fc280473bed23f2e1ed324e102a48f7d17e1 < 3883e9702b6a4945e93b16c070f338a9f5b496f9`\n- `Linux >= e284fc280473bed23f2e1ed324e102a48f7d17e1 < 3118f41d8fa57b005f53ec3db2ba5eab1d7ba12b`\n- `Linux >= e284fc280473bed23f2e1ed324e102a48f7d17e1 < 560e1683410585fbd5df847f43433c4296f0d222`\n- `Linux >= e284fc280473bed23f2e1ed324e102a48f7d17e1 < 9739d5830497812b0bdeaee356ddefbe60830b88`\n- `Linux 4.17`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":48,"depthScoreParts":{"impact":48.4,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}