CVE-2025-39969 (GCVE-0-2025-39969)

Vulnerability from cvelistv5 – Published: 2025-10-15 07:55 – Updated: 2026-08-05 12:06
VLAI
Title
i40e: fix validation of VF state in get resources
Summary
In the Linux kernel, the following vulnerability has been resolved: i40e: fix validation of VF state in get resources VF state I40E_VF_STATE_ACTIVE is not the only state in which VF is actually active so it should not be used to determine if a VF is allowed to obtain resources. Use I40E_VF_STATE_RESOURCES_LOADED that is set only in i40e_vc_get_vf_resources_msg() and cleared during reset.
Severity
8.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 171527da84149c2c7aa6a60a64b09d24f3546298 , < 185745d56ec958bf8aa773828213237dfcc32f5a (git)
Affected: eb87117c27e729b0aeef4d72ed40d6a1761b0f68 , < f47876788a23de296c42ef9d505b5c1630f0b4b8 (git)
Affected: 2132643b956f553f5abddc9bae20dae267b082e0 , < 8e35c80f8570426fe0f0cc92b151ebd835975f22 (git)
Affected: 61125b8be85dfbc7e9c7fe1cc6c6d631ab603516 , < 6c3981fd59ef11a75005ac9978f034da5a168b6a (git)
Affected: 61125b8be85dfbc7e9c7fe1cc6c6d631ab603516 , < e748f1ee493f88e38b77363a60499f979d42c58a (git)
Affected: 61125b8be85dfbc7e9c7fe1cc6c6d631ab603516 , < 6128bbc7adc25c87c2f64b5eb66a280b78ef7ab7 (git)
Affected: 61125b8be85dfbc7e9c7fe1cc6c6d631ab603516 , < a991dc56d3e9a2c3db87d0c3f03c24f6595400f1 (git)
Affected: 61125b8be85dfbc7e9c7fe1cc6c6d631ab603516 , < 877b7e6ffc23766448236e8732254534c518ba42 (git)
Affected: 5.4.165 , < 5.4.300 (semver)
Affected: 5.10.85 , < 5.10.245 (semver)
Affected: 5.15.8 , < 5.15.194 (semver)
guessed Create a notification for this product.
Linux Linux Affected: 5.16
Unaffected: 0 , < 5.16 (semver)
Unaffected: 5.4.300 , ≤ 5.4.* (semver)
Unaffected: 5.10.245 , ≤ 5.10.* (semver)
Unaffected: 5.15.194 , ≤ 5.15.* (semver)
Unaffected: 6.1.155 , ≤ 6.1.* (semver)
Unaffected: 6.6.109 , ≤ 6.6.* (semver)
Unaffected: 6.12.50 , ≤ 6.12.* (semver)
Unaffected: 6.16.10 , ≤ 6.16.* (semver)
Unaffected: 6.17 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c",
            "drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "185745d56ec958bf8aa773828213237dfcc32f5a",
              "status": "affected",
              "version": "171527da84149c2c7aa6a60a64b09d24f3546298",
              "versionType": "git"
            },
            {
              "lessThan": "f47876788a23de296c42ef9d505b5c1630f0b4b8",
              "status": "affected",
              "version": "eb87117c27e729b0aeef4d72ed40d6a1761b0f68",
              "versionType": "git"
            },
            {
              "lessThan": "8e35c80f8570426fe0f0cc92b151ebd835975f22",
              "status": "affected",
              "version": "2132643b956f553f5abddc9bae20dae267b082e0",
              "versionType": "git"
            },
            {
              "lessThan": "6c3981fd59ef11a75005ac9978f034da5a168b6a",
              "status": "affected",
              "version": "61125b8be85dfbc7e9c7fe1cc6c6d631ab603516",
              "versionType": "git"
            },
            {
              "lessThan": "e748f1ee493f88e38b77363a60499f979d42c58a",
              "status": "affected",
              "version": "61125b8be85dfbc7e9c7fe1cc6c6d631ab603516",
              "versionType": "git"
            },
            {
              "lessThan": "6128bbc7adc25c87c2f64b5eb66a280b78ef7ab7",
              "status": "affected",
              "version": "61125b8be85dfbc7e9c7fe1cc6c6d631ab603516",
              "versionType": "git"
            },
            {
              "lessThan": "a991dc56d3e9a2c3db87d0c3f03c24f6595400f1",
              "status": "affected",
              "version": "61125b8be85dfbc7e9c7fe1cc6c6d631ab603516",
              "versionType": "git"
            },
            {
              "lessThan": "877b7e6ffc23766448236e8732254534c518ba42",
              "status": "affected",
              "version": "61125b8be85dfbc7e9c7fe1cc6c6d631ab603516",
              "versionType": "git"
            },
            {
              "lessThan": "5.4.300",
              "status": "affected",
              "version": "5.4.165",
              "versionType": "semver"
            },
            {
              "lessThan": "5.10.245",
              "status": "affected",
              "version": "5.10.85",
              "versionType": "semver"
            },
            {
              "lessThan": "5.15.194",
              "status": "affected",
              "version": "5.15.8",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c",
            "drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.16"
            },
            {
              "lessThan": "5.16",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.300",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.245",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.194",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.155",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.109",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.50",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.16.*",
              "status": "unaffected",
              "version": "6.16.10",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.17",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.300",
                  "versionStartIncluding": "5.4.165",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.245",
                  "versionStartIncluding": "5.10.85",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.194",
                  "versionStartIncluding": "5.15.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.155",
                  "versionStartIncluding": "5.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.109",
                  "versionStartIncluding": "5.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.50",
                  "versionStartIncluding": "5.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.16.10",
                  "versionStartIncluding": "5.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.17",
                  "versionStartIncluding": "5.16",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ni40e: fix validation of VF state in get resources\n\nVF state I40E_VF_STATE_ACTIVE is not the only state in which\nVF is actually active so it should not be used to determine\nif a VF is allowed to obtain resources.\n\nUse I40E_VF_STATE_RESOURCES_LOADED that is set only in\ni40e_vc_get_vf_resources_msg() and cleared during reset."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The attack is delivered over the i40e SR-IOV virtchnl mailbox by a VF the attacker already controls (guest VM with VF passthrough, or a VFIO-owning container), not over any network protocol. This is local access from the attacking context into the host PF driver.\nAC:L - `VIRTCHNL_OP_GET_VF_RESOURCES` is accepted unconditionally whenever `I40E_VF_STATE_INIT` is set, so the VF can replay it deterministically at any time with no grooming; the deterministic damage (filter teardown, `driver_caps`/`RDMAENA` reset, spurious `ACTIVE`) needs no race at all, and the freed-VSI window is widened by the handler\u0027s own `GFP_KERNEL` sleep, which the attacker can hammer at will.\nPR:L - The attacker only needs the ability to drive the VF\u0027s admin queue \u2014 kernel/root inside the assigned guest or possession of the VFIO device \u2014 which is a low-privileged position with respect to the host PF driver under attack. No host-side privileges are required.\nUI:N - The malicious VF sends the virtchnl messages entirely on its own initiative. No host administrator or other user action is needed at any point.\nS:C - The attacker executes in a guest VM (or VF-assigned container) while the corrupted state, the freed-VSI accesses, and the MAC-filter/MMIO programming all occur in the host PF driver\u0027s security authority. Impact reaches the hypervisor and other VFs/guests sharing the adapter, crossing the guest/host boundary.\nC:H - The unserialized handler reads `vsi-\u003einfo.pvid`, `vsi-\u003ealloc_queue_pairs` and `vsi-\u003einfo.qs_handle[0]` from a VSI that `i40e_free_vf_res()` may have already released and echoes those values back to the guest in the `virtchnl_vf_resource` reply, turning a use-after-free read into a direct host-memory disclosure channel. The VF can also read back state belonging to the PF\u0027s main VSI when `lan_vsi_idx` has been zeroed.\nI:H - The same path performs `spin_lock_bh(\u0026vsi-\u003emac_filter_hash_lock)` and `i40e_del_mac_filter()` \u2014 lock and hash-list writes \u2014 on freed memory, a classic UAF write primitive, and can be aimed at `pf-\u003evsi[0]` (the host\u0027s main VSI) to delete the host\u0027s own L2 filters. Re-toggling `I40E_VF_STATE_RDMAENA` additionally re-opens `i40e_config_rdma_qvlist()`, which programs `I40E_VPINT_CEQCTL` from an unvalidated VF-supplied index.\nA:H - Dereferencing a released `struct i40e_vsi` and taking a spinlock inside freed memory will oops or panic the host kernel, and tearing down a live VF\u0027s MAC filters plus corrupting the PF\u0027s ACTIVE/RDMA state wedges networking for that VF and the adapter. A host panic takes down the hypervisor and every guest on it, and the VF can retrigger the condition indefinitely."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:06:38.466Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/185745d56ec958bf8aa773828213237dfcc32f5a"
        },
        {
          "url": "https://git.kernel.org/stable/c/f47876788a23de296c42ef9d505b5c1630f0b4b8"
        },
        {
          "url": "https://git.kernel.org/stable/c/8e35c80f8570426fe0f0cc92b151ebd835975f22"
        },
        {
          "url": "https://git.kernel.org/stable/c/6c3981fd59ef11a75005ac9978f034da5a168b6a"
        },
        {
          "url": "https://git.kernel.org/stable/c/e748f1ee493f88e38b77363a60499f979d42c58a"
        },
        {
          "url": "https://git.kernel.org/stable/c/6128bbc7adc25c87c2f64b5eb66a280b78ef7ab7"
        },
        {
          "url": "https://git.kernel.org/stable/c/a991dc56d3e9a2c3db87d0c3f03c24f6595400f1"
        },
        {
          "url": "https://git.kernel.org/stable/c/877b7e6ffc23766448236e8732254534c518ba42"
        }
      ],
      "title": "i40e: fix validation of VF state in get resources",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-39969",
    "datePublished": "2025-10-15T07:55:52.948Z",
    "dateReserved": "2025-04-16T07:20:57.149Z",
    "dateUpdated": "2026-08-05T12:06:38.466Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-39969",
      "date": "2026-09-23",
      "epss": "0.00154",
      "percentile": "0.04986"
    },
    "microsoft_vex": {
      "current_release_date": "2025-10-16T01:02:04.000Z",
      "cve": "CVE-2025-39969",
      "id": "msrc_CVE-2025-39969",
      "initial_release_date": "2025-10-02T00:00:00.000Z",
      "product_status:fixed": "1",
      "product_status:known_affected": "2",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "i40e: fix validation of VF state in get resources",
      "url": "https://msrc.microsoft.com/csaf/vex/2025/msrc_cve-2025-39969.json",
      "version": "1"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c",
                  "drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.h"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "185745d56ec958bf8aa773828213237dfcc32f5a",
                    "status": "affected",
                    "version": "171527da84149c2c7aa6a60a64b09d24f3546298",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "f47876788a23de296c42ef9d505b5c1630f0b4b8",
                    "status": "affected",
                    "version": "eb87117c27e729b0aeef4d72ed40d6a1761b0f68",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "8e35c80f8570426fe0f0cc92b151ebd835975f22",
                    "status": "affected",
                    "version": "2132643b956f553f5abddc9bae20dae267b082e0",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "6c3981fd59ef11a75005ac9978f034da5a168b6a",
                    "status": "affected",
                    "version": "61125b8be85dfbc7e9c7fe1cc6c6d631ab603516",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "e748f1ee493f88e38b77363a60499f979d42c58a",
                    "status": "affected",
                    "version": "61125b8be85dfbc7e9c7fe1cc6c6d631ab603516",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "6128bbc7adc25c87c2f64b5eb66a280b78ef7ab7",
                    "status": "affected",
                    "version": "61125b8be85dfbc7e9c7fe1cc6c6d631ab603516",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "a991dc56d3e9a2c3db87d0c3f03c24f6595400f1",
                    "status": "affected",
                    "version": "61125b8be85dfbc7e9c7fe1cc6c6d631ab603516",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "877b7e6ffc23766448236e8732254534c518ba42",
                    "status": "affected",
                    "version": "61125b8be85dfbc7e9c7fe1cc6c6d631ab603516",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "5.4.300",
                    "status": "affected",
                    "version": "5.4.165",
                    "versionType": "semver"
                  },
                  {
                    "lessThan": "5.10.245",
                    "status": "affected",
                    "version": "5.10.85",
                    "versionType": "semver"
                  },
                  {
                    "lessThan": "5.15.194",
                    "status": "affected",
                    "version": "5.15.8",
                    "versionType": "semver"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c",
                  "drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.h"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "5.16"
                  },
                  {
                    "lessThan": "5.16",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.4.*",
                    "status": "unaffected",
                    "version": "5.4.300",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.10.*",
                    "status": "unaffected",
                    "version": "5.10.245",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.15.*",
                    "status": "unaffected",
                    "version": "5.15.194",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.1.*",
                    "status": "unaffected",
                    "version": "6.1.155",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.6.*",
                    "status": "unaffected",
                    "version": "6.6.109",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.50",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.16.*",
                    "status": "unaffected",
                    "version": "6.16.10",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "6.17",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ni40e: fix validation of VF state in get resources\n\nVF state I40E_VF_STATE_ACTIVE is not the only state in which\nVF is actually active so it should not be used to determine\nif a VF is allowed to obtain resources.\n\nUse I40E_VF_STATE_RESOURCES_LOADED that is set only in\ni40e_vc_get_vf_resources_msg() and cleared during reset."
          }
        ],
        "id": "CVE-2025-39969",
        "lastModified": "2026-07-30T06:24:02.640",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 8.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "CHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 2.0,
              "impactScore": 6.0,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2025-10-15T08:15:34.483",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/185745d56ec958bf8aa773828213237dfcc32f5a"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/6128bbc7adc25c87c2f64b5eb66a280b78ef7ab7"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/6c3981fd59ef11a75005ac9978f034da5a168b6a"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/877b7e6ffc23766448236e8732254534c518ba42"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/8e35c80f8570426fe0f0cc92b151ebd835975f22"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/a991dc56d3e9a2c3db87d0c3f03c24f6595400f1"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/e748f1ee493f88e38b77363a60499f979d42c58a"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/f47876788a23de296c42ef9d505b5c1630f0b4b8"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Deferred"
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-07-30T08:54:11+00:00",
      "cve": "CVE-2025-39969",
      "id": "CVE-2025-39969",
      "initial_release_date": "2025-10-15T00:00:00+00:00",
      "product_status:known_affected": "232",
      "product_status:known_not_affected": "42",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: i40e: fix validation of VF state in get resources",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-39969.json",
      "version": "3"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.