CVE-2025-39968

A flaw was found in the Linux kernel's i40e network driver. A local attacker with low privileges can exploit a missing maximum boundary check for Virtual Function (VF) filters. By requesting an unbounded number of filters, the attacker can cause resource exhaustion, leading to a denial of service (DoS). This issue may also impact the confidentiality and integrity of data due to the system's compromised state.

A flaw of moderate severity was found in the Linux kernel's i40e network driver shipped in Red Hat Enterprise Linux. The driver lacked a maximum boundary check on the number of filters a Virtual Function (VF) may request. A local attacker with low privileges who can issue VF filter requests could request an unbounded number of filters and exhaust driver resources, resulting in a denial of service. Red Hat Enterprise Linux 7, 8, 9, and 10 (kernel and kernel-rt) are affected; the fix is currently deferred for these streams, so the residual risk of local resource exhaustion and denial of service remains until a fix is delivered. Red Hat Enterprise Linux 6 Extended Lifecycle Support and Red Hat In-Vehicle OS 1 are marked not affected because the vulnerable code is not present in those products. Red Hat assessed this flaw as Moderate (CVSS 5.3) rather than the upstream CVE.org High rating (7.3) because exploitation requires local access with VF privileges and the primary consequence is availability impact through resource exhaustion.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Prevent the i40e kernel module from loading to mitigate this vulnerability. Create a file /etc/modprobe.d/i40e-blacklist.conf with the following content:

blacklist i40e
install i40e /bin/true

Then, regenerate the initramfs and reboot the system for the changes to take effect. This action will disable the i40e network driver, potentially impacting network functionality if i40e-based network adapters are in use. A system reboot is required for the changes to be fully applied.