---
id: CVE-2025-39969
title: 'i40e: fix validation of VF state in get resources'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  i40e: fix validation of VF state in get resources

  VF state I40E_VF_STATE_ACTIVE is not the only state in which
  VF is actually active so it should not be used to determ…
severity: high
cvss: 8.8
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H'
cvssSource: cna
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 171527da84149c2c7aa6a60a64b09d24f3546298 <
    185745d56ec958bf8aa773828213237dfcc32f5a
  - >-
    Linux >= eb87117c27e729b0aeef4d72ed40d6a1761b0f68 <
    f47876788a23de296c42ef9d505b5c1630f0b4b8
  - >-
    Linux >= 2132643b956f553f5abddc9bae20dae267b082e0 <
    8e35c80f8570426fe0f0cc92b151ebd835975f22
  - >-
    Linux >= 61125b8be85dfbc7e9c7fe1cc6c6d631ab603516 <
    6c3981fd59ef11a75005ac9978f034da5a168b6a
  - >-
    Linux >= 61125b8be85dfbc7e9c7fe1cc6c6d631ab603516 <
    e748f1ee493f88e38b77363a60499f979d42c58a
  - >-
    Linux >= 61125b8be85dfbc7e9c7fe1cc6c6d631ab603516 <
    6128bbc7adc25c87c2f64b5eb66a280b78ef7ab7
  - >-
    Linux >= 61125b8be85dfbc7e9c7fe1cc6c6d631ab603516 <
    a991dc56d3e9a2c3db87d0c3f03c24f6595400f1
  - >-
    Linux >= 61125b8be85dfbc7e9c7fe1cc6c6d631ab603516 <
    877b7e6ffc23766448236e8732254534c518ba42
  - Linux >= 5.4.165 < 5.4.300
  - Linux >= 5.10.85 < 5.10.245
  - Linux >= 5.15.8 < 5.15.194
  - Linux 5.16
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-10-15T21:55:24.332500Z'
published: '2025-10-15'
updated: '2026-10-15'
sourceUpdated: '2026-10-15T22:02:34.578Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2025-39969'
references:
  - url: 'https://git.kernel.org/stable/c/185745d56ec958bf8aa773828213237dfcc32f5a'
  - url: 'https://git.kernel.org/stable/c/f47876788a23de296c42ef9d505b5c1630f0b4b8'
  - url: 'https://git.kernel.org/stable/c/8e35c80f8570426fe0f0cc92b151ebd835975f22'
  - url: 'https://git.kernel.org/stable/c/6c3981fd59ef11a75005ac9978f034da5a168b6a'
  - url: 'https://git.kernel.org/stable/c/e748f1ee493f88e38b77363a60499f979d42c58a'
  - url: 'https://git.kernel.org/stable/c/6128bbc7adc25c87c2f64b5eb66a280b78ef7ab7'
  - url: 'https://git.kernel.org/stable/c/a991dc56d3e9a2c3db87d0c3f03c24f6595400f1'
  - url: 'https://git.kernel.org/stable/c/877b7e6ffc23766448236e8732254534c518ba42'
tags:
  - cve.org
epss: 0.00154
epssPercentile: 0.04522
ingestedAt: '2026-10-15T22:48:25.534Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

i40e: fix validation of VF state in get resources

VF state I40E_VF_STATE_ACTIVE is not the only state in which
VF is actually active so it should not be used to determine
if a VF is allowed to obtain resources.

Use I40E_VF_STATE_RESOURCES_LOADED that is set only in
i40e_vc_get_vf_resources_msg() and cleared during reset.

## Affected

- `Linux >= 171527da84149c2c7aa6a60a64b09d24f3546298 < 185745d56ec958bf8aa773828213237dfcc32f5a`
- `Linux >= eb87117c27e729b0aeef4d72ed40d6a1761b0f68 < f47876788a23de296c42ef9d505b5c1630f0b4b8`
- `Linux >= 2132643b956f553f5abddc9bae20dae267b082e0 < 8e35c80f8570426fe0f0cc92b151ebd835975f22`
- `Linux >= 61125b8be85dfbc7e9c7fe1cc6c6d631ab603516 < 6c3981fd59ef11a75005ac9978f034da5a168b6a`
- `Linux >= 61125b8be85dfbc7e9c7fe1cc6c6d631ab603516 < e748f1ee493f88e38b77363a60499f979d42c58a`
- `Linux >= 61125b8be85dfbc7e9c7fe1cc6c6d631ab603516 < 6128bbc7adc25c87c2f64b5eb66a280b78ef7ab7`
- `Linux >= 61125b8be85dfbc7e9c7fe1cc6c6d631ab603516 < a991dc56d3e9a2c3db87d0c3f03c24f6595400f1`
- `Linux >= 61125b8be85dfbc7e9c7fe1cc6c6d631ab603516 < 877b7e6ffc23766448236e8732254534c518ba42`
- `Linux >= 5.4.165 < 5.4.300`
- `Linux >= 5.10.85 < 5.10.245`
- `Linux >= 5.15.8 < 5.15.194`
- `Linux 5.16`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.