CVE-2025-39971

A flaw was found in the Linux kernel in the Intel i40e network driver such that in the function i40e_vc_config_queues_msg(), when iterating over vf->ch[idx], the idx value is not properly validated against the range of active/initialized traffic classes (TCs). An attacker with local privileges could supply a malformed value causing an out-of-bounds access, potentially leading to memory corruption, system crash, or possible arbitrary code execution.

This vulnerability is rated as Moderate severity for Red Hat Enterprise Linux because exploitation requires access to a host configured with specific Intel Ethernet hardware running active SR-IOV virtual functions. The flaw can only be triggered by an attacker operating within a privileged guest environment or an assigned virtual function capable of sending malformed virtual channel requests to the host driver. Standard deployments lacking Intel 700-series network adapters or those that do not allocate SR-IOV virtual functions to untrusted workloads are not exposed to this issue.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.