CVE-2025-39969

In the Linux kernel, the following vulnerability has been resolved:

i40e: fix validation of VF state in get resources

VF state I40E_VF_STATE_ACTIVE is not the only state in which VF is actually active so it should not be used to determine if a VF is allowed to obtain resources.

Use I40E_VF_STATE_RESOURCES_LOADED that is set only in i40e_vc_get_vf_resources_msg() and cleared during reset.

This vulnerability can in theory be triggered by an unprivileged user with guest access to a virtual machine, since the primary issue arises when the VF driver initializes (ex. during a VM boot/reboot) and then sends a virtchnl message to the PF. Note however that this attack path is non-deterministic, as the unprivileged user does not have control over the timing of the calls that could lead to the PF to perform improper state validation.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.