CVE-2025-39853

In the Linux kernel, the following vulnerability has been resolved:

i40e: Fix potential invalid access when MAC list is empty

list_first_entry() never returns NULL - if the list is empty, it still returns a pointer to an invalid object, leading to potential invalid memory access when dereferenced.

Fix this by using list_first_entry_or_null instead of list_first_entry.

The Intel i40e client interface could dereference an invalid list entry when the netdev MAC address list is empty, leading to a kernel crash. The fix switches to list_first_entry_or_null() and guards the copy, preventing invalid memory access when no MAC is present. This is locally triggerable in specific i40e/iWARP configurations (typically requiring CAP_NET_ADMIN) and primarily results in a DoS.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.