Memory Access Vulnerability in Linux Kernel's i40e Module

CVE-2025-39853

What is CVE-2025-39853?

A memory access vulnerability exists in the i40e module of the Linux kernel. When the MAC list is empty, invoking the function list_first_entry() returns a pointer to an invalid object instead of NULL. This can result in potential invalid memory access during dereferencing, which could compromise system integrity. The vulnerability has been addressed by replacing list_first_entry() with list_first_entry_or_null() to ensure that proper checks on the list state are enforced, preventing improper memory access.

References