CVE-2025-38200

In the Linux kernel, the following vulnerability has been resolved:

i40e: fix MMIO write access to an invalid page in i40e_clear_hw

When the device sends a specific input, an integer underflow can occur, leading to MMIO write access to an invalid page.

Prevent the integer underflow by changing the type of related variables.

This vulnerability is rated as Moderate impact because exploitation requires the presence of specific Intel Ethernet hardware or an attached device capable of supplying malformed responses during driver operations, preventing direct remote exploitation over standard network traffic. The flaw resides in the i40e network driver, which is compiled as a kernel module in Red Hat Enterprise Linux and is only loaded when matching physical or virtual adapters are initialized. Consequently, systems that do not use Intel 700 Series network interfaces are not exposed to this issue.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.