FKIE_CVE-2025-40104

Vulnerability from fkie_nvd - Published: 2025-10-30 10:15 - Updated: 2026-10-19 21:10
Severity
7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Summary
In the Linux kernel, the following vulnerability has been resolved: ixgbevf: fix mailbox API compatibility by negotiating supported features There was backward compatibility in the terms of mailbox API. Various drivers from various OSes supporting 10G adapters from Intel portfolio could easily negotiate mailbox API. This convention has been broken since introducing API 1.4. Commit 0062e7cc955e ("ixgbevf: add VF IPsec offload code") added support for IPSec which is specific only for the kernel ixgbe driver. None of the rest of the Intel 10G PF/VF drivers supports it. And actually lack of support was not included in the IPSec implementation - there were no such code paths. No possibility to negotiate support for the feature was introduced along with introduction of the feature itself. Commit 339f28964147 ("ixgbevf: Add support for new mailbox communication between PF and VF") increasing API version to 1.5 did the same - it introduced code supported specifically by the PF ESX driver. It altered API version for the VF driver in the same time not touching the version defined for the PF ixgbe driver. It led to additional discrepancies, as the code provided within API 1.6 cannot be supported for Linux ixgbe driver as it causes crashes. The issue was noticed some time ago and mitigated by Jake within the commit d0725312adf5 ("ixgbevf: stop attempting IPSEC offload on Mailbox API 1.5"). As a result we have regression for IPsec support and after increasing API to version 1.6 ixgbevf driver stopped to support ESX MBX. To fix this mess add new mailbox op asking PF driver about supported features. Basing on a response determine whether to set support for IPSec and ESX-specific enhanced mailbox. New mailbox op, for compatibility purposes, must be added within new API revision, as API version of OOT PF & VF drivers is already increased to 1.6 and doesn't incorporate features negotiate op. Features negotiation mechanism gives possibility to be extended with new features when needed in the future.
References
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/2e0aab9ddaf1428602c78f12064cd1e6ffcc4d18
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/871ac1cd4ce4804defcb428cbb003fd84c415ff4
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/a376e29b1b196dc90b50df7e5e3947e3026300c4
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/a7075f501bd33c93570af759b6f4302ef0175168
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/bf580112ed61736c2645a893413a04732505d4b1
Impacted products
Vendor Product Version
To clipboard 

{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/intel/ixgbevf/ipsec.c",
            "drivers/net/ethernet/intel/ixgbevf/ixgbevf.h",
            "drivers/net/ethernet/intel/ixgbevf/ixgbevf_main.c",
            "drivers/net/ethernet/intel/ixgbevf/mbx.h",
            "drivers/net/ethernet/intel/ixgbevf/vf.c",
            "drivers/net/ethernet/intel/ixgbevf/vf.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "871ac1cd4ce4804defcb428cbb003fd84c415ff4",
              "status": "affected",
              "version": "0062e7cc955e0827a88570ed36ea511a7dcb391e",
              "versionType": "git"
            },
            {
              "lessThan": "2e0aab9ddaf1428602c78f12064cd1e6ffcc4d18",
              "status": "affected",
              "version": "0062e7cc955e0827a88570ed36ea511a7dcb391e",
              "versionType": "git"
            },
            {
              "lessThan": "bf580112ed61736c2645a893413a04732505d4b1",
              "status": "affected",
              "version": "0062e7cc955e0827a88570ed36ea511a7dcb391e",
              "versionType": "git"
            },
            {
              "lessThan": "a376e29b1b196dc90b50df7e5e3947e3026300c4",
              "status": "affected",
              "version": "0062e7cc955e0827a88570ed36ea511a7dcb391e",
              "versionType": "git"
            },
            {
              "lessThan": "a7075f501bd33c93570af759b6f4302ef0175168",
              "status": "affected",
              "version": "0062e7cc955e0827a88570ed36ea511a7dcb391e",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/intel/ixgbevf/ipsec.c",
            "drivers/net/ethernet/intel/ixgbevf/ixgbevf.h",
            "drivers/net/ethernet/intel/ixgbevf/ixgbevf_main.c",
            "drivers/net/ethernet/intel/ixgbevf/mbx.h",
            "drivers/net/ethernet/intel/ixgbevf/vf.c",
            "drivers/net/ethernet/intel/ixgbevf/vf.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.20"
            },
            {
              "lessThan": "4.20",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.158",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.114",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.55",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.17.*",
              "status": "unaffected",
              "version": "6.17.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.18",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nixgbevf: fix mailbox API compatibility by negotiating supported features\n\nThere was backward compatibility in the terms of mailbox API. Various\ndrivers from various OSes supporting 10G adapters from Intel portfolio\ncould easily negotiate mailbox API.\n\nThis convention has been broken since introducing API 1.4.\nCommit 0062e7cc955e (\"ixgbevf: add VF IPsec offload code\") added support\nfor IPSec which is specific only for the kernel ixgbe driver. None of the\nrest of the Intel 10G PF/VF drivers supports it. And actually lack of\nsupport was not included in the IPSec implementation - there were no such\ncode paths. No possibility to negotiate support for the feature was\nintroduced along with introduction of the feature itself.\n\nCommit 339f28964147 (\"ixgbevf: Add support for new mailbox communication\nbetween PF and VF\") increasing API version to 1.5 did the same - it\nintroduced code supported specifically by the PF ESX driver. It altered API\nversion for the VF driver in the same time not touching the version\ndefined for the PF ixgbe driver. It led to additional discrepancies,\nas the code provided within API 1.6 cannot be supported for Linux ixgbe\ndriver as it causes crashes.\n\nThe issue was noticed some time ago and mitigated by Jake within the commit\nd0725312adf5 (\"ixgbevf: stop attempting IPSEC offload on Mailbox API 1.5\").\nAs a result we have regression for IPsec support and after increasing API\nto version 1.6 ixgbevf driver stopped to support ESX MBX.\n\nTo fix this mess add new mailbox op asking PF driver about supported\nfeatures. Basing on a response determine whether to set support for IPSec\nand ESX-specific enhanced mailbox.\n\nNew mailbox op, for compatibility purposes, must be added within new API\nrevision, as API version of OOT PF \u0026 VF drivers is already increased to\n1.6 and doesn\u0027t incorporate features negotiate op.\n\nFeatures negotiation mechanism gives possibility to be extended with new\nfeatures when needed in the future."
    },
    {
      "lang": "es",
      "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nixgbevf: corrige la compatibilidad de la API del buz\u00f3n negociando las caracter\u00edsticas soportadas\n\nHab\u00eda compatibilidad hacia atr\u00e1s en t\u00e9rminos de la API del buz\u00f3n. Varios controladores de varios sistemas operativos que soportaban adaptadores de 10G de la cartera de Intel pod\u00edan negociar f\u00e1cilmente la API del buz\u00f3n.\n\nEsta convenci\u00f3n se ha roto desde la introducci\u00f3n de la API 1.4. El commit 0062e7cc955e (\u201cixgbevf: add VF IPsec offload code\u201d) a\u00f1adi\u00f3 soporte para IPSec, que es espec\u00edfico solo para el controlador ixgbe del kernel. Ninguno del resto de los controladores PF/VF de 10G de Intel lo soporta. Y, de hecho, la falta de soporte no se incluy\u00f3 en la implementaci\u00f3n de IPSec; no exist\u00edan tales rutas de c\u00f3digo. No se introdujo ninguna posibilidad de negociar el soporte para la caracter\u00edstica junto con la introducci\u00f3n de la caracter\u00edstica misma.\n\nEl commit 339f28964147 (\u201cixgbevf: Add support for new mailbox communication between PF and VF\u201d), que aument\u00f3 la versi\u00f3n de la API a 1.5, hizo lo mismo: introdujo c\u00f3digo soportado espec\u00edficamente por el controlador PF ESX. Alter\u00f3 la versi\u00f3n de la API para el controlador VF al mismo tiempo que no toc\u00f3 la versi\u00f3n definida para el controlador PF ixgbe. Esto llev\u00f3 a discrepancias adicionales, ya que el c\u00f3digo proporcionado dentro de la API 1.6 no puede ser soportado para el controlador ixgbe de Linux, ya que causa fallos.\n\nEl problema fue notado hace alg\u00fan tiempo y mitigado por Jake dentro del commit d0725312adf5 (\u201cixgbevf: stop attempting IPSEC offload on Mailbox API 1.5\u201d). Como resultado, tenemos una regresi\u00f3n para el soporte de IPsec y, despu\u00e9s de aumentar la API a la versi\u00f3n 1.6, el controlador ixgbevf dej\u00f3 de soportar ESX MBX.\n\nPara arreglar este l\u00edo, se a\u00f1ade una nueva operaci\u00f3n de buz\u00f3n que pregunta al controlador PF sobre las caracter\u00edsticas soportadas. Bas\u00e1ndose en una respuesta, se determina si establecer el soporte para IPSec y el buz\u00f3n mejorado espec\u00edfico de ESX.\n\nLa nueva operaci\u00f3n de buz\u00f3n, para prop\u00f3sitos de compatibilidad, debe ser a\u00f1adida dentro de una nueva revisi\u00f3n de la API, ya que la versi\u00f3n de la API de los controladores OOT PF y VF ya ha sido aumentada a 1.6 y no incorpora la operaci\u00f3n de negociaci\u00f3n de caracter\u00edsticas.\n\nEl mecanismo de negociaci\u00f3n de caracter\u00edsticas da la posibilidad de ser extendido con nuevas caracter\u00edsticas cuando sea necesario en el futuro."
    }
  ],
  "id": "CVE-2025-40104",
  "lastModified": "2026-10-19T21:10:00.160",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "LOCAL",
          "availabilityImpact": "HIGH",
          "baseScore": 7.8,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 1.8,
        "impactScore": 5.9,
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-40104",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-10-15T21:56:54.238520Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2025-10-30T10:15:34.783",
  "references": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/2e0aab9ddaf1428602c78f12064cd1e6ffcc4d18"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/871ac1cd4ce4804defcb428cbb003fd84c415ff4"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/a376e29b1b196dc90b50df7e5e3947e3026300c4"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/a7075f501bd33c93570af759b6f4302ef0175168"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/bf580112ed61736c2645a893413a04732505d4b1"
    }
  ],
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
  "vulnStatus": "Deferred"
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.

Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

JSON

Loading timeline…




    Related by attack behaviour

    Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.