PT-2025-42245 · Linux+5 · Linux Kernel+5

Published 2025-09-18 · Updated 2026-05-07 · CVE-2025-39970

Positive Technologies (AI Summary)

CVSS v2.0

6.0

Medium

Base vector

AV:L/AC:H/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A flaw exists in the Linux kernel's i40e driver related to input validation for the action meta component. The issue involves a condition check that was insufficient, potentially leading to an out-of-bounds (OOB) dereference. The correction involves modifying the condition to properly check for 'greater or equal' to prevent this dereference.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

NULL Pointer Dereference

Weakness Enumeration

CWE-476

Related Identifiers

AZL-68471

BDU:2026-02704

CVE-2025-39970

DLA-4379-1

DLA-4404-1

DSA-6053-1

ECHO-9FFA-DF76-7F9E

MGASA-2025-0309

MGASA-2025-0310

OESA-2025-2633

OESA-2025-2634

OESA-2025-2635

OESA-2026-1075

OESA-2026-1076

OPENSUSE-SU-2025:20091-1

SUSE-SU-2025:21040-1

SUSE-SU-2025:21052-1

SUSE-SU-2025:21056-1

SUSE-SU-2025:21064-1

SUSE-SU-2025:21080-1

SUSE-SU-2025:21147-1

SUSE-SU-2025:21180-1

SUSE-SU-2025:4057-1

SUSE-SU-2025:4128-1

SUSE-SU-2025:4132-1

SUSE-SU-2025:4140-1

SUSE-SU-2025:4141-1

SUSE-SU-2025:4189-1

SUSE-SU-2025:4301-1

USN-8033-1

USN-8033-2

USN-8033-3

USN-8033-4

USN-8033-5

USN-8033-6

USN-8033-7

USN-8033-8

USN-8034-1

USN-8034-2

USN-8095-1

USN-8095-2

USN-8095-3

USN-8095-4

USN-8095-5

USN-8100-1

USN-8125-1

USN-8126-1

USN-8141-1

USN-8163-1

USN-8163-2

USN-8165-1

USN-8243-1

USN-8261-1

Affected Products

Debian

Linuxmint

Linux Kernel

Suse

Ubuntu

I40E

References · 2806

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/39xxx/CVE-2025-39970.json · Exploit
• https://ubuntu.com/security/CVE-2025-38055 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-40092 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-21833 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-39788 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-38251 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-38543 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2025-0309.html · Security Note
• https://ubuntu.com/security/CVE-2026-23026 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-40284 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-68803 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-40307 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-37844 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-68264 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-23146 · Vendor Advisory