Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2025-39911— i40e: fix IRQ freeing in i40e_vsi_request_irq_msix error path

Quick assessment

Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于错误路径中IRQ释放时使用了错误的dev_id参数，可能导致资源释放不当。

AI Predicted 4.3 Difficulty: Easy EPSS 0.16% · P5

Possible ATT&CK Techniques 1 AI

T1499 · Endpoint Denial of Service

Affected Version Matrix 18

VendorProduct Version RangeStatus
Linux Linux 493fb30011b3ab5173cef96f1d1ce126da051792< 13ab9adef3cd386511c930a9660ae06595007f89 affected
493fb30011b3ab5173cef96f1d1ce126da051792< 6e4016c0dca53afc71e3b99e24252b63417395df affected
493fb30011b3ab5173cef96f1d1ce126da051792< b9721a023df38cf44a88f2739b4cf51efd051f85 affected
493fb30011b3ab5173cef96f1d1ce126da051792< b905b2acb3a0bbb08ad9be9984d8cdabdf827315 affected
493fb30011b3ab5173cef96f1d1ce126da051792< 23431998a37764c464737b855c71a81d50992e98 affected
493fb30011b3ab5173cef96f1d1ce126da051792< a30afd6617c30aaa338d1dbcb1e34e7a1890085c affected
493fb30011b3ab5173cef96f1d1ce126da051792< c62580674ce5feb1be4f90b5873ff3ce50e0a1db affected
493fb30011b3ab5173cef96f1d1ce126da051792< 915470e1b44e71d1dd07ee067276f003c3521ee3 affected
… +10 more rows
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2025-39911

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
i40e: fix IRQ freeing in i40e_vsi_request_irq_msix error path
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: i40e: fix IRQ freeing in i40e_vsi_request_irq_msix error path If request_irq() in i40e_vsi_request_irq_msix() fails in an iteration later than the first, the error path wants to free the IRQs requested so far. However, it uses the wrong dev_id argument for free_irq(), so it does not free the IRQs correctly and instead triggers the warning: Trying to free already-free IRQ 173 WARNING: CPU: 25 PID: 1091 at kernel/irq/manage.c:1829 __free_irq+0x192/0x2c0 Modules linked in: i40e(+) [...] CPU: 25 UID: 0 PID: 1091 Comm: NetworkManager Not tainted 6.17.0-rc1+ #1 PREEMPT(lazy) Hardware name: [...] RIP: 0010:__free_irq+0x192/0x2c0 [...] Call Trace: <TASK> free_irq+0x32/0x70 i40e_vsi_request_irq_msix.cold+0x63/0x8b [i40e] i40e_vsi_request_irq+0x79/0x80 [i40e] i40e_vsi_open+0x21f/0x2f0 [i40e] i40e_open+0x63/0x130 [i40e] __dev_open+0xfc/0x210 __dev_change_flags+0x1fc/0x240 netif_change_flags+0x27/0x70 do_setlink.isra.0+0x341/0xc70 rtnl_newlink+0x468/0x860 rtnetlink_rcv_msg+0x375/0x450 netlink_rcv_skb+0x5c/0x110 netlink_unicast+0x288/0x3c0 netlink_sendmsg+0x20d/0x430 ____sys_sendmsg+0x3a2/0x3d0 ___sys_sendmsg+0x99/0xe0 __sys_sendmsg+0x8a/0xf0 do_syscall_64+0x82/0x2c0 entry_SYSCALL_64_after_hwframe+0x76/0x7e [...] </TASK> ---[ end trace 0000000000000000 ]--- Use the same dev_id for free_irq() as for request_irq(). I tested this with inserting code to fail intentionally.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Linux kernel 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于错误路径中IRQ释放时使用了错误的dev_id参数，可能导致资源释放不当。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
Linux Linux 493fb30011b3ab5173cef96f1d1ce126da051792 ~ 13ab9adef3cd386511c930a9660ae06595007f89 -
Linux Linux 3.13 -

II. Public POCs for CVE-2025-39911

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2025-39911

请登录查看更多情报信息。

Patches & Fixes for CVE-2025-39911 (3)

Same Patch Batch · Linux · 2025-10-01 · 169 CVEs total

CVE-2023-53517 9.8 CRITICAL tipc: do not update mtu if msg_max is too small in mtu negotiation
CVE-2025-39919 8.8 HIGH wifi: mt76: mt7996: add missing check for rx wcid entries
CVE-2025-39918 8.8 HIGH wifi: mt76: fix linked list corruption
CVE-2023-53454 8.8 HIGH HID: multitouch: Correct devm device reference for hidinput input_dev name
CVE-2022-50442 8.4 HIGH fs/ntfs3: Validate buffer length while parsing index
CVE-2023-53493 8.4 HIGH accel/qaic: tighten bounds checking in decode_message()
CVE-2023-53492 7.8 HIGH netfilter: nf_tables: do not ignore genmask when looking up chain by id
CVE-2025-39924 7.8 HIGH erofs: fix invalid algorithm for encoded extents
CVE-2023-53510 7.8 HIGH scsi: ufs: core: Fix handling of lrbp->cmd
CVE-2025-39927 7.8 HIGH ceph: fix race condition validating r_parent before applying state
CVE-2022-50421 7.8 HIGH rpmsg: char: Avoid double destroy of default endpoint
CVE-2023-53506 7.8 HIGH udf: Do not bother merging very long extents
CVE-2022-50423 7.8 HIGH ACPICA: Fix use-after-free in acpi_ut_copy_ipackage_to_ipackage()
CVE-2023-53504 7.8 HIGH RDMA/bnxt_re: Properly order ib_device_unalloc() to avoid UAF
CVE-2023-53495 7.8 HIGH net: ethernet: mvpp2_main: fix possible OOB write in mvpp2_ethtool_get_rxnfc()
CVE-2023-53494 7.8 HIGH crypto: xts - Handle EBUSY correctly
CVE-2022-50437 7.8 HIGH drm/msm/hdmi: fix memory corruption with too many bridges
CVE-2023-53478 7.8 HIGH tracing/synthetic: Fix races on freeing last_cmd
CVE-2023-53481 7.8 HIGH ubi: ubi_wl_put_peb: Fix infinite loop when wear-leveling work failed
CVE-2023-53486 7.8 HIGH fs/ntfs3: Enhance the attribute size check

Showing top 20 of 169 CVEs. View all on vendor page &rarr; →

IV. Related Vulnerabilities

Same product: Linux
Same vendor: Linux

V. Comments for CVE-2025-39911

No comments yet

Leave a comment