{"id":"CVE-2025-39972","title":"i40e: fix idx validation in i40e_validate_queue_map","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\ni40e: fix idx validation in i40e_validate_queue_map\n\nEnsure idx is within range of active/initialized TCs when iterating over\nvf->ch[idx] in i40e_validate_queue_map().","severity":"high","cvss":8.8,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","cvssSource":"cna","vendor":"Linux","product":"Linux","affected":["Linux >= c27eac48160de72dee33d42b5a33cc7b8a2eb1f5 < b6cb93a7ff208f324c7ec581d72995f80e115e0e","Linux >= c27eac48160de72dee33d42b5a33cc7b8a2eb1f5 < 6f15a7b34fae75e745bdc2ec05e06ddfd0dd2f3c","Linux >= c27eac48160de72dee33d42b5a33cc7b8a2eb1f5 < 34dfac0c904829967d500c51f216916ce1452957","Linux >= c27eac48160de72dee33d42b5a33cc7b8a2eb1f5 < 4d5e804a9e19b639b18fd13664dbad3c03c79e61","Linux >= c27eac48160de72dee33d42b5a33cc7b8a2eb1f5 < 50a1e2f50f6c22b93b94eb8d168a1be3c05bf5cd","Linux >= c27eac48160de72dee33d42b5a33cc7b8a2eb1f5 < cc4191e8ef40d2249c1b9a8617d22ec8a976b574","Linux >= c27eac48160de72dee33d42b5a33cc7b8a2eb1f5 < d4e3eaaa3cb3af77836d806c89cd6ebf533a7320","Linux >= c27eac48160de72dee33d42b5a33cc7b8a2eb1f5 < aa68d3c3ac8d1dcec40d52ae27e39f6d32207009","Linux 4.17"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total","timestamp":"2026-10-15T21:55:31.394478Z"},"published":"2025-10-15","updated":"2026-10-15","sourceUpdated":"2026-10-15T22:02:34.827Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2025-39972","references":[{"url":"https://git.kernel.org/stable/c/b6cb93a7ff208f324c7ec581d72995f80e115e0e"},{"url":"https://git.kernel.org/stable/c/6f15a7b34fae75e745bdc2ec05e06ddfd0dd2f3c"},{"url":"https://git.kernel.org/stable/c/34dfac0c904829967d500c51f216916ce1452957"},{"url":"https://git.kernel.org/stable/c/4d5e804a9e19b639b18fd13664dbad3c03c79e61"},{"url":"https://git.kernel.org/stable/c/50a1e2f50f6c22b93b94eb8d168a1be3c05bf5cd"},{"url":"https://git.kernel.org/stable/c/cc4191e8ef40d2249c1b9a8617d22ec8a976b574"},{"url":"https://git.kernel.org/stable/c/d4e3eaaa3cb3af77836d806c89cd6ebf533a7320"},{"url":"https://git.kernel.org/stable/c/aa68d3c3ac8d1dcec40d52ae27e39f6d32207009"}],"tags":["cve.org"],"epss":0.00154,"epssPercentile":0.04523,"ingestedAt":"2026-10-15T22:48:25.533Z","slug":"CVE-2025-39972","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ni40e: fix idx validation in i40e_validate_queue_map\n\nEnsure idx is within range of active/initialized TCs when iterating over\nvf->ch[idx] in i40e_validate_queue_map().\n\n## Affected\n\n- `Linux >= c27eac48160de72dee33d42b5a33cc7b8a2eb1f5 < b6cb93a7ff208f324c7ec581d72995f80e115e0e`\n- `Linux >= c27eac48160de72dee33d42b5a33cc7b8a2eb1f5 < 6f15a7b34fae75e745bdc2ec05e06ddfd0dd2f3c`\n- `Linux >= c27eac48160de72dee33d42b5a33cc7b8a2eb1f5 < 34dfac0c904829967d500c51f216916ce1452957`\n- `Linux >= c27eac48160de72dee33d42b5a33cc7b8a2eb1f5 < 4d5e804a9e19b639b18fd13664dbad3c03c79e61`\n- `Linux >= c27eac48160de72dee33d42b5a33cc7b8a2eb1f5 < 50a1e2f50f6c22b93b94eb8d168a1be3c05bf5cd`\n- `Linux >= c27eac48160de72dee33d42b5a33cc7b8a2eb1f5 < cc4191e8ef40d2249c1b9a8617d22ec8a976b574`\n- `Linux >= c27eac48160de72dee33d42b5a33cc7b8a2eb1f5 < d4e3eaaa3cb3af77836d806c89cd6ebf533a7320`\n- `Linux >= c27eac48160de72dee33d42b5a33cc7b8a2eb1f5 < aa68d3c3ac8d1dcec40d52ae27e39f6d32207009`\n- `Linux 4.17`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":48,"depthScoreParts":{"impact":48.4,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}