CVE-2025-39853: i40e: Fix potential invalid access when MAC list is empty
i40e: Fix potential invalid access when MAC list is empty
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.113-1Fixed in 7.2.12-1Fixed in 7.2.13-1 - Compensating control
In the Linux kernel i40e code, replace list_first_entry() with list_first_entry_or_null() when accessing the MAC list, so an empty list returns NULL instead of an invalid object pointer.
Event History
Frequently Asked Questions
What is the severity of CVE-2025-39853?
CVE-2025-39853 is classified as a potential security vulnerability due to invalid memory access risk.
How do I fix CVE-2025-39853?
To fix CVE-2025-39853, update your Linux kernel to the latest stable version where the vulnerability is patched.
What types of systems are affected by CVE-2025-39853?
CVE-2025-39853 affects systems running the Linux kernel, particularly those utilizing the i40e driver.
Can CVE-2025-39853 be exploited?
Yes, CVE-2025-39853 can potentially be exploited due to invalid access, leading to system instability or crashes.
When was CVE-2025-39853 disclosed?
CVE-2025-39853 was disclosed following updates to the Linux kernel addressing the issue.