In the Linux kernel, the following vulnerability has been resolved: i40e: Fix potential invalid access when MAC list is empty list_first_entry() never returns NULL - if the list is empty, it still returns a pointer to an invalid object, leading to potential invalid memory access when dereferenced. Fix this by using list_first_entry_or_null instead of list_first_entry.

Metrics

No CVSS v4.0

Attack Vector Local

Attack Complexity High

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Affected Vendors & Products

Vendors Products
Linux
  • Linux Kernel

No data.

No data.

References
Link Providers
https://git.kernel.org/stable/c/1eadabcf5623f1237a539b16586b4ed8ac8dffcd cve-icon cve-icon
https://git.kernel.org/stable/c/3c6fb929afa313d9d11f780451d113f73922fe5d cve-icon cve-icon
https://git.kernel.org/stable/c/66e7cdbda74ee823ec2bf7b830ebd235c54f5ddf cve-icon cve-icon
https://git.kernel.org/stable/c/971feafe157afac443027acdc235badc6838560b cve-icon cve-icon
https://git.kernel.org/stable/c/9c21fc4cebd44dd21016c61261a683af390343f8 cve-icon cve-icon
https://git.kernel.org/stable/c/a556f06338e1d5a85af0e32ecb46e365547f92b9 cve-icon cve-icon
https://git.kernel.org/stable/c/e2a5e74879f9b494bbd66fa93f355feacde450c7 cve-icon cve-icon
https://git.kernel.org/stable/c/fb216d980fae6561c7c70af8ef826faf059c6515 cve-icon cve-icon
https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html cve-icon
https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html cve-icon
https://lore.kernel.org/linux-cve-announce/2025091904-CVE-2025-39853-a617@gregkh/T cve-icon
https://nvd.nist.gov/vuln/detail/CVE-2025-39853 cve-icon
https://www.cve.org/CVERecord?id=CVE-2025-39853 cve-icon
History

Mon, 03 Nov 2025 18:30:00 +0000

Type Values Removed Values Added
References

Mon, 22 Sep 2025 10:15:00 +0000

Type Values Removed Values Added
First Time appeared Linux
Linux linux Kernel
Vendors & Products Linux
Linux linux Kernel

Sat, 20 Sep 2025 00:15:00 +0000

Type Values Removed Values Added
References
Metrics threat_severity

None

 cvssV3_1

{'score': 7.0, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H'}

threat_severity

Moderate

Fri, 19 Sep 2025 15:30:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: i40e: Fix potential invalid access when MAC list is empty list_first_entry() never returns NULL - if the list is empty, it still returns a pointer to an invalid object, leading to potential invalid memory access when dereferenced. Fix this by using list_first_entry_or_null instead of list_first_entry.
Title i40e: Fix potential invalid access when MAC list is empty
References
cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2025-09-19T15:26:25.101Z

Updated: 2025-11-03T17:44:09.789Z

Reserved: 2025-04-16T07:20:57.142Z

Link: CVE-2025-39853

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Awaiting Analysis

Published: 2025-09-19T16:15:44.213

Modified: 2025-11-03T18:16:50.560

Link: CVE-2025-39853

cve-icon Redhat

Severity : Moderate

Publid Date: 2025-09-19T00:00:00Z

Links: CVE-2025-39853 - Bugzilla