Review reviewHigh

CVE-2025-39971

Linux

In the Linux kernel, the following vulnerability has been resolved: i40e: fix idx validation in config queues msg Ensure idx is within range of active/initialized TCs when iterating over vf->ch[idx] in i40e_vc_config_queues_msg().

CVSS: 8.8
EPSS: 0.14%
CISA KEV: Not listed
Published: 2025.10.15

PRIORITY ASSESSMENT

Review review

The CVSS severity warrants an early asset and exposure review.

Known exploitationNot established by KEV

Exploit probability0.14%

Technical severityCVSS 8.8

Vulnerability overview

Affected product and versions

Product: Linux
Affected versions: >= c27eac48160de72dee33d42b5a33cc7b8a2eb1f5 < a6ff2af78343eceb0f77ab1a2fe802183bc21648, >= c27eac48160de72dee33d42b5a33cc7b8a2eb1f5 < f5f91d164af22e7147130ef8bebbdb28d8ecc6e2, >= c27eac48160de72dee33d42b5a33cc7b8a2eb1f5 < 1fa0aadade34481c567cdf4a897c0d4e4d548bd1, >= c27eac48160de72dee33d42b5a33cc7b8a2eb1f5 < 8b9c7719b0987b1c6c5fc910599f3618a558dbde, >= c27eac48160de72dee33d42b5a33cc7b8a2eb1f5 < 2cc26dac0518d2fa9b67ec813ee60e183480f98a, >= c27eac48160de72dee33d42b5a33cc7b8a2eb1f5 < bfcc1dff429d4b99ba03e40ddacc68ea4be2b32b, >= c27eac48160de72dee33d42b5a33cc7b8a2eb1f5 < 5c1f96123113e0bdc6d8dc2b0830184c93da9f65, >= c27eac48160de72dee33d42b5a33cc7b8a2eb1f5 < f1ad24c5abe1eaef69158bac1405a74b3c365115, >= 4.17
Fixed versions: No verified fixed-version field is available yet

Recommended response sequence

Confirm exposure before applying a vendor-supported change.

Full remediation guide

1
Identify
Confirm that Linux and an affected version are present.
2
Prioritize
Combine exploitation signals with asset exposure and business criticality.
3
Remediate
Follow the vendor advisory or supported update path and preserve rollback options.
4
Verify
Recheck the version, service health, access paths, and relevant logs.

Technical data

CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
CWE: Not available