CVE-2025-39972

In the Linux kernel, the following vulnerability has been resolved:

i40e: fix idx validation in i40e_validate_queue_map

Ensure idx is within range of active/initialized TCs when iterating over vf->ch[idx] in i40e_validate_queue_map().

This vulnerability is rated as Moderate impact because exploitation requires access to a virtual function (VF) interface on systems equipped with Intel 700 Series network hardware running SR-IOV. A malicious or compromised guest operating system managing an allocated VF can trigger an out-of-bounds read during queue map validation in the host physical function driver. While this flaw can result in a host kernel crash leading to a denial of service, it cannot be exploited remotely and does not directly permit arbitrary code execution.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.