CVE-2025-40104

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-40104", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2025-04-16T07:20:57.165Z", "datePublished": "2025-10-30T09:48:09.051Z", "dateUpdated": "2026-10-15T22:02:37.869Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:07:49.716Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nixgbevf: fix mailbox API compatibility by negotiating supported features\n\nThere was backward compatibility in the terms of mailbox API. Various\ndrivers from various OSes supporting 10G adapters from Intel portfolio\ncould easily negotiate mailbox API.\n\nThis convention has been broken since introducing API 1.4.\nCommit 0062e7cc955e (\"ixgbevf: add VF IPsec offload code\") added support\nfor IPSec which is specific only for the kernel ixgbe driver. None of the\nrest of the Intel 10G PF/VF drivers supports it. And actually lack of\nsupport was not included in the IPSec implementation - there were no such\ncode paths. No possibility to negotiate support for the feature was\nintroduced along with introduction of the feature itself.\n\nCommit 339f28964147 (\"ixgbevf: Add support for new mailbox communication\nbetween PF and VF\") increasing API version to 1.5 did the same - it\nintroduced code supported specifically by the PF ESX driver. It altered API\nversion for the VF driver in the same time not touching the version\ndefined for the PF ixgbe driver. It led to additional discrepancies,\nas the code provided within API 1.6 cannot be supported for Linux ixgbe\ndriver as it causes crashes.\n\nThe issue was noticed some time ago and mitigated by Jake within the commit\nd0725312adf5 (\"ixgbevf: stop attempting IPSEC offload on Mailbox API 1.5\").\nAs a result we have regression for IPsec support and after increasing API\nto version 1.6 ixgbevf driver stopped to support ESX MBX.\n\nTo fix this mess add new mailbox op asking PF driver about supported\nfeatures. Basing on a response determine whether to set support for IPSec\nand ESX-specific enhanced mailbox.\n\nNew mailbox op, for compatibility purposes, must be added within new API\nrevision, as API version of OOT PF & VF drivers is already increased to\n1.6 and doesn't incorporate features negotiate op.\n\nFeatures negotiation mechanism gives possibility to be extended with new\nfeatures when needed in the future."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - The defect is exercised entirely through the local PCIe PF/VF mailbox during `ixgbevf_probe()`/`ixgbevf_reset()` and through the local xfrm netlink offload path (`xdo_dev_state_add`); no remote or adjacent-network peer data reaches the vulnerable negotiation logic.\nAC:L - On any host whose PF is not the Linux `ixgbe` driver (VMware ESXi, Windows, FreeBSD, or Intel's OOT PF \u2014 all of which accept API 1.4/1.5/1.6), the wrong feature set is selected deterministically on every single driver load with no race, timing window, or memory-layout dependency, and it can be re-triggered indefinitely via link down/up.\nPR:L - SR-IOV VFs are routinely delegated into container/VM network namespaces (sriov-cni and friends), and `xfrm_user_rcv_msg()` gates SA creation on `netlink_net_capable(CAP_NET_ADMIN)`, i.e. `ns_capable()` against the netns' owning user namespace \u2014 so an otherwise-unprivileged account that owns a userns holding the VF can drive `ixgbevf_ipsec_add_sa()` and repeated `ixgbevf_reset()`/renegotiation.\nUI:N - The mismatched feature state is established automatically during driver bring-up and every subsequent reset, and the IPsec SA installation is performed by the attacker themselves; no action by any other user is required.\nS:U - Both the defect and its consequences are confined to the kernel running `ixgbevf` on the VF side; no hypervisor, IOMMU, or sandbox boundary is crossed, since the PF is the peer that the VF misjudges rather than the victim.\nC:H - Because the VF advertises `NETIF_F_HW_ESP` against a PF with no IPsec implementation, `ixgbevf_ipsec_set_pf_sa()` ships the raw AES-GCM key and SA parameters to a peer never negotiated to handle message 0x0e and marks the SA hardware-offloaded on any non-FAILURE reply, after which `esp_xmit()` skips software encryption \u2014 the full plaintext of the supposedly ESP-protected traffic leaves on the wire, and cryptographic key material is disclosed to an unnegotiated consumer.\nI:H - The same false offload claim removes ESP integrity protection from transmitted traffic while `ixgbevf_ipsec_rx()` stamps `CRYPTO_DONE`/`CRYPTO_SUCCESS` on frames whose ICV was never verified in hardware, so the stack accepts and forwards unauthenticated data as if it had passed IPsec verification.\nA:H - The commit states outright that the version-only feature selection \"causes crashes\" when the API-1.6 code paths run against the Linux `ixgbe` PF, and the mismatched ESX mailbox plus the wrongly latched `mac->get_link_status = false` in `ixgbevf_check_mac_link_vf()` desynchronize PF/VF communication and permanently wedge the VF's link state, leaving the interface dead."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/net/ethernet/intel/ixgbevf/ipsec.c", "drivers/net/ethernet/intel/ixgbevf/ixgbevf.h", "drivers/net/ethernet/intel/ixgbevf/ixgbevf_main.c", "drivers/net/ethernet/intel/ixgbevf/mbx.h", "drivers/net/ethernet/intel/ixgbevf/vf.c", "drivers/net/ethernet/intel/ixgbevf/vf.h"], "versions": [{"version": "0062e7cc955e0827a88570ed36ea511a7dcb391e", "lessThan": "871ac1cd4ce4804defcb428cbb003fd84c415ff4", "status": "affected", "versionType": "git"}, {"version": "0062e7cc955e0827a88570ed36ea511a7dcb391e", "lessThan": "2e0aab9ddaf1428602c78f12064cd1e6ffcc4d18", "status": "affected", "versionType": "git"}, {"version": "0062e7cc955e0827a88570ed36ea511a7dcb391e", "lessThan": "bf580112ed61736c2645a893413a04732505d4b1", "status": "affected", "versionType": "git"}, {"version": "0062e7cc955e0827a88570ed36ea511a7dcb391e", "lessThan": "a376e29b1b196dc90b50df7e5e3947e3026300c4", "status": "affected", "versionType": "git"}, {"version": "0062e7cc955e0827a88570ed36ea511a7dcb391e", "lessThan": "a7075f501bd33c93570af759b6f4302ef0175168", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/net/ethernet/intel/ixgbevf/ipsec.c", "drivers/net/ethernet/intel/ixgbevf/ixgbevf.h", "drivers/net/ethernet/intel/ixgbevf/ixgbevf_main.c", "drivers/net/ethernet/intel/ixgbevf/mbx.h", "drivers/net/ethernet/intel/ixgbevf/vf.c", "drivers/net/ethernet/intel/ixgbevf/vf.h"], "versions": [{"version": "4.20", "status": "affected"}, {"version": "0", "lessThan": "4.20", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.158", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.114", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.55", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.17.5", "lessThanOrEqual": "6.17.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.20", "versionEndExcluding": "6.1.158"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.20", "versionEndExcluding": "6.6.114"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.20", "versionEndExcluding": "6.12.55"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.20", "versionEndExcluding": "6.17.5"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.20", "versionEndExcluding": "6.18"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/871ac1cd4ce4804defcb428cbb003fd84c415ff4"}, {"url": "https://git.kernel.org/stable/c/2e0aab9ddaf1428602c78f12064cd1e6ffcc4d18"}, {"url": "https://git.kernel.org/stable/c/bf580112ed61736c2645a893413a04732505d4b1"}, {"url": "https://git.kernel.org/stable/c/a376e29b1b196dc90b50df7e5e3947e3026300c4"}, {"url": "https://git.kernel.org/stable/c/a7075f501bd33c93570af759b6f4302ef0175168"}], "title": "ixgbevf: fix mailbox API compatibility by negotiating supported features", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-40104", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-15T21:56:54.238520Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-15T22:02:37.869Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-40104", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-15T21:56:54.238520Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-15T21:56:55.157Z"}}], "cna": {"title": "ixgbevf: fix mailbox API compatibility by negotiating supported features", "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 7.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}, "scenarios": [{"lang": "en", "value": "AV:L - The defect is exercised entirely through the local PCIe PF/VF mailbox during `ixgbevf_probe()`/`ixgbevf_reset()` and through the local xfrm netlink offload path (`xdo_dev_state_add`); no remote or adjacent-network peer data reaches the vulnerable negotiation logic.\nAC:L - On any host whose PF is not the Linux `ixgbe` driver (VMware ESXi, Windows, FreeBSD, or Intel's OOT PF \u2014 all of which accept API 1.4/1.5/1.6), the wrong feature set is selected deterministically on every single driver load with no race, timing window, or memory-layout dependency, and it can be re-triggered indefinitely via link down/up.\nPR:L - SR-IOV VFs are routinely delegated into container/VM network namespaces (sriov-cni and friends), and `xfrm_user_rcv_msg()` gates SA creation on `netlink_net_capable(CAP_NET_ADMIN)`, i.e. `ns_capable()` against the netns' owning user namespace \u2014 so an otherwise-unprivileged account that owns a userns holding the VF can drive `ixgbevf_ipsec_add_sa()` and repeated `ixgbevf_reset()`/renegotiation.\nUI:N - The mismatched feature state is established automatically during driver bring-up and every subsequent reset, and the IPsec SA installation is performed by the attacker themselves; no action by any other user is required.\nS:U - Both the defect and its consequences are confined to the kernel running `ixgbevf` on the VF side; no hypervisor, IOMMU, or sandbox boundary is crossed, since the PF is the peer that the VF misjudges rather than the victim.\nC:H - Because the VF advertises `NETIF_F_HW_ESP` against a PF with no IPsec implementation, `ixgbevf_ipsec_set_pf_sa()` ships the raw AES-GCM key and SA parameters to a peer never negotiated to handle message 0x0e and marks the SA hardware-offloaded on any non-FAILURE reply, after which `esp_xmit()` skips software encryption \u2014 the full plaintext of the supposedly ESP-protected traffic leaves on the wire, and cryptographic key material is disclosed to an unnegotiated consumer.\nI:H - The same false offload claim removes ESP integrity protection from transmitted traffic while `ixgbevf_ipsec_rx()` stamps `CRYPTO_DONE`/`CRYPTO_SUCCESS` on frames whose ICV was never verified in hardware, so the stack accepts and forwards unauthenticated data as if it had passed IPsec verification.\nA:H - The commit states outright that the version-only feature selection \"causes crashes\" when the API-1.6 code paths run against the Linux `ixgbe` PF, and the mismatched ESX mailbox plus the wrongly latched `mac->get_link_status = false` in `ixgbevf_check_mac_link_vf()` desynchronize PF/VF communication and permanently wedge the VF's link state, leaving the interface dead."}]}], "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "0062e7cc955e0827a88570ed36ea511a7dcb391e", "lessThan": "871ac1cd4ce4804defcb428cbb003fd84c415ff4", "versionType": "git"}, {"status": "affected", "version": "0062e7cc955e0827a88570ed36ea511a7dcb391e", "lessThan": "2e0aab9ddaf1428602c78f12064cd1e6ffcc4d18", "versionType": "git"}, {"status": "affected", "version": "0062e7cc955e0827a88570ed36ea511a7dcb391e", "lessThan": "bf580112ed61736c2645a893413a04732505d4b1", "versionType": "git"}, {"status": "affected", "version": "0062e7cc955e0827a88570ed36ea511a7dcb391e", "lessThan": "a376e29b1b196dc90b50df7e5e3947e3026300c4", "versionType": "git"}, {"status": "affected", "version": "0062e7cc955e0827a88570ed36ea511a7dcb391e", "lessThan": "a7075f501bd33c93570af759b6f4302ef0175168", "versionType": "git"}], "programFiles": ["drivers/net/ethernet/intel/ixgbevf/ipsec.c", "drivers/net/ethernet/intel/ixgbevf/ixgbevf.h", "drivers/net/ethernet/intel/ixgbevf/ixgbevf_main.c", "drivers/net/ethernet/intel/ixgbevf/mbx.h", "drivers/net/ethernet/intel/ixgbevf/vf.c", "drivers/net/ethernet/intel/ixgbevf/vf.h"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "4.20"}, {"status": "unaffected", "version": "0", "lessThan": "4.20", "versionType": "semver"}, {"status": "unaffected", "version": "6.1.158", "versionType": "semver", "lessThanOrEqual": "6.1.*"}, {"status": "unaffected", "version": "6.6.114", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.12.55", "versionType": "semver", "lessThanOrEqual": "6.12.*"}, {"status": "unaffected", "version": "6.17.5", "versionType": "semver", "lessThanOrEqual": "6.17.*"}, {"status": "unaffected", "version": "6.18", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["drivers/net/ethernet/intel/ixgbevf/ipsec.c", "drivers/net/ethernet/intel/ixgbevf/ixgbevf.h", "drivers/net/ethernet/intel/ixgbevf/ixgbevf_main.c", "drivers/net/ethernet/intel/ixgbevf/mbx.h", "drivers/net/ethernet/intel/ixgbevf/vf.c", "drivers/net/ethernet/intel/ixgbevf/vf.h"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/871ac1cd4ce4804defcb428cbb003fd84c415ff4"}, {"url": "https://git.kernel.org/stable/c/2e0aab9ddaf1428602c78f12064cd1e6ffcc4d18"}, {"url": "https://git.kernel.org/stable/c/bf580112ed61736c2645a893413a04732505d4b1"}, {"url": "https://git.kernel.org/stable/c/a376e29b1b196dc90b50df7e5e3947e3026300c4"}, {"url": "https://git.kernel.org/stable/c/a7075f501bd33c93570af759b6f4302ef0175168"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nixgbevf: fix mailbox API compatibility by negotiating supported features\n\nThere was backward compatibility in the terms of mailbox API. Various\ndrivers from various OSes supporting 10G adapters from Intel portfolio\ncould easily negotiate mailbox API.\n\nThis convention has been broken since introducing API 1.4.\nCommit 0062e7cc955e (\"ixgbevf: add VF IPsec offload code\") added support\nfor IPSec which is specific only for the kernel ixgbe driver. None of the\nrest of the Intel 10G PF/VF drivers supports it. And actually lack of\nsupport was not included in the IPSec implementation - there were no such\ncode paths. No possibility to negotiate support for the feature was\nintroduced along with introduction of the feature itself.\n\nCommit 339f28964147 (\"ixgbevf: Add support for new mailbox communication\nbetween PF and VF\") increasing API version to 1.5 did the same - it\nintroduced code supported specifically by the PF ESX driver. It altered API\nversion for the VF driver in the same time not touching the version\ndefined for the PF ixgbe driver. It led to additional discrepancies,\nas the code provided within API 1.6 cannot be supported for Linux ixgbe\ndriver as it causes crashes.\n\nThe issue was noticed some time ago and mitigated by Jake within the commit\nd0725312adf5 (\"ixgbevf: stop attempting IPSEC offload on Mailbox API 1.5\").\nAs a result we have regression for IPsec support and after increasing API\nto version 1.6 ixgbevf driver stopped to support ESX MBX.\n\nTo fix this mess add new mailbox op asking PF driver about supported\nfeatures. Basing on a response determine whether to set support for IPSec\nand ESX-specific enhanced mailbox.\n\nNew mailbox op, for compatibility purposes, must be added within new API\nrevision, as API version of OOT PF & VF drivers is already increased to\n1.6 and doesn't incorporate features negotiate op.\n\nFeatures negotiation mechanism gives possibility to be extended with new\nfeatures when needed in the future."}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.1.158", "versionStartIncluding": "4.20"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.6.114", "versionStartIncluding": "4.20"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.12.55", "versionStartIncluding": "4.20"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.17.5", "versionStartIncluding": "4.20"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.18", "versionStartIncluding": "4.20"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:07:49.716Z"}}}, "cveMetadata": {"cveId": "CVE-2025-40104", "state": "PUBLISHED", "dateUpdated": "2026-10-15T22:02:37.869Z", "dateReserved": "2025-04-16T07:20:57.165Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2025-10-30T09:48:09.051Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/net/ethernet/intel/ixgbevf/ipsec.c", "drivers/net/ethernet/intel/ixgbevf/ixgbevf.h", "drivers/net/ethernet/intel/ixgbevf/ixgbevf_main.c", "drivers/net/ethernet/intel/ixgbevf/mbx.h", "drivers/net/ethernet/intel/ixgbevf/vf.c", "drivers/net/ethernet/intel/ixgbevf/vf.h"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "871ac1cd4ce4804defcb428cbb003fd84c415ff4", "status": "affected", "version": "0062e7cc955e0827a88570ed36ea511a7dcb391e", "versionType": "git"}, {"lessThan": "2e0aab9ddaf1428602c78f12064cd1e6ffcc4d18", "status": "affected", "version": "0062e7cc955e0827a88570ed36ea511a7dcb391e", "versionType": "git"}, {"lessThan": "bf580112ed61736c2645a893413a04732505d4b1", "status": "affected", "version": "0062e7cc955e0827a88570ed36ea511a7dcb391e", "versionType": "git"}, {"lessThan": "a376e29b1b196dc90b50df7e5e3947e3026300c4", "status": "affected", "version": "0062e7cc955e0827a88570ed36ea511a7dcb391e", "versionType": "git"}, {"lessThan": "a7075f501bd33c93570af759b6f4302ef0175168", "status": "affected", "version": "0062e7cc955e0827a88570ed36ea511a7dcb391e", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/net/ethernet/intel/ixgbevf/ipsec.c", "drivers/net/ethernet/intel/ixgbevf/ixgbevf.h", "drivers/net/ethernet/intel/ixgbevf/ixgbevf_main.c", "drivers/net/ethernet/intel/ixgbevf/mbx.h", "drivers/net/ethernet/intel/ixgbevf/vf.c", "drivers/net/ethernet/intel/ixgbevf/vf.h"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "4.20"}, {"lessThan": "4.20", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.158", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.114", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.55", "versionType": "semver"}, {"lessThanOrEqual": "6.17.*", "status": "unaffected", "version": "6.17.5", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "6.18", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nixgbevf: fix mailbox API compatibility by negotiating supported features\n\nThere was backward compatibility in the terms of mailbox API. Various\ndrivers from various OSes supporting 10G adapters from Intel portfolio\ncould easily negotiate mailbox API.\n\nThis convention has been broken since introducing API 1.4.\nCommit 0062e7cc955e (\"ixgbevf: add VF IPsec offload code\") added support\nfor IPSec which is specific only for the kernel ixgbe driver. None of the\nrest of the Intel 10G PF/VF drivers supports it. And actually lack of\nsupport was not included in the IPSec implementation - there were no such\ncode paths. No possibility to negotiate support for the feature was\nintroduced along with introduction of the feature itself.\n\nCommit 339f28964147 (\"ixgbevf: Add support for new mailbox communication\nbetween PF and VF\") increasing API version to 1.5 did the same - it\nintroduced code supported specifically by the PF ESX driver. It altered API\nversion for the VF driver in the same time not touching the version\ndefined for the PF ixgbe driver. It led to additional discrepancies,\nas the code provided within API 1.6 cannot be supported for Linux ixgbe\ndriver as it causes crashes.\n\nThe issue was noticed some time ago and mitigated by Jake within the commit\nd0725312adf5 (\"ixgbevf: stop attempting IPSEC offload on Mailbox API 1.5\").\nAs a result we have regression for IPsec support and after increasing API\nto version 1.6 ixgbevf driver stopped to support ESX MBX.\n\nTo fix this mess add new mailbox op asking PF driver about supported\nfeatures. Basing on a response determine whether to set support for IPSec\nand ESX-specific enhanced mailbox.\n\nNew mailbox op, for compatibility purposes, must be added within new API\nrevision, as API version of OOT PF & VF drivers is already increased to\n1.6 and doesn't incorporate features negotiate op.\n\nFeatures negotiation mechanism gives possibility to be extended with new\nfeatures when needed in the future."}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nixgbevf: corrige la compatibilidad de la API del buz\u00f3n negociando las caracter\u00edsticas soportadas\n\nHab\u00eda compatibilidad hacia atr\u00e1s en t\u00e9rminos de la API del buz\u00f3n. Varios controladores de varios sistemas operativos que soportaban adaptadores de 10G de la cartera de Intel pod\u00edan negociar f\u00e1cilmente la API del buz\u00f3n.\n\nEsta convenci\u00f3n se ha roto desde la introducci\u00f3n de la API 1.4. El commit 0062e7cc955e (\u201cixgbevf: add VF IPsec offload code\u201d) a\u00f1adi\u00f3 soporte para IPSec, que es espec\u00edfico solo para el controlador ixgbe del kernel. Ninguno del resto de los controladores PF/VF de 10G de Intel lo soporta. Y, de hecho, la falta de soporte no se incluy\u00f3 en la implementaci\u00f3n de IPSec; no exist\u00edan tales rutas de c\u00f3digo. No se introdujo ninguna posibilidad de negociar el soporte para la caracter\u00edstica junto con la introducci\u00f3n de la caracter\u00edstica misma.\n\nEl commit 339f28964147 (\u201cixgbevf: Add support for new mailbox communication between PF and VF\u201d), que aument\u00f3 la versi\u00f3n de la API a 1.5, hizo lo mismo: introdujo c\u00f3digo soportado espec\u00edficamente por el controlador PF ESX. Alter\u00f3 la versi\u00f3n de la API para el controlador VF al mismo tiempo que no toc\u00f3 la versi\u00f3n definida para el controlador PF ixgbe. Esto llev\u00f3 a discrepancias adicionales, ya que el c\u00f3digo proporcionado dentro de la API 1.6 no puede ser soportado para el controlador ixgbe de Linux, ya que causa fallos.\n\nEl problema fue notado hace alg\u00fan tiempo y mitigado por Jake dentro del commit d0725312adf5 (\u201cixgbevf: stop attempting IPSEC offload on Mailbox API 1.5\u201d). Como resultado, tenemos una regresi\u00f3n para el soporte de IPsec y, despu\u00e9s de aumentar la API a la versi\u00f3n 1.6, el controlador ixgbevf dej\u00f3 de soportar ESX MBX.\n\nPara arreglar este l\u00edo, se a\u00f1ade una nueva operaci\u00f3n de buz\u00f3n que pregunta al controlador PF sobre las caracter\u00edsticas soportadas. Bas\u00e1ndose en una respuesta, se determina si establecer el soporte para IPSec y el buz\u00f3n mejorado espec\u00edfico de ESX.\n\nLa nueva operaci\u00f3n de buz\u00f3n, para prop\u00f3sitos de compatibilidad, debe ser a\u00f1adida dentro de una nueva revisi\u00f3n de la API, ya que la versi\u00f3n de la API de los controladores OOT PF y VF ya ha sido aumentada a 1.6 y no incorpora la operaci\u00f3n de negociaci\u00f3n de caracter\u00edsticas.\n\nEl mecanismo de negociaci\u00f3n de caracter\u00edsticas da la posibilidad de ser extendido con nuevas caracter\u00edsticas cuando sea necesario en el futuro."}], "id": "CVE-2025-40104", "lastModified": "2026-10-19T21:10:00.160", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-40104", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-10-15T21:56:54.238520Z", "version": "2.0.3"}}]}, "published": "2025-10-30T10:15:34.783", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/2e0aab9ddaf1428602c78f12064cd1e6ffcc4d18"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/871ac1cd4ce4804defcb428cbb003fd84c415ff4"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/a376e29b1b196dc90b50df7e5e3947e3026300c4"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/a7075f501bd33c93570af759b6f4302ef0175168"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/bf580112ed61736c2645a893413a04732505d4b1"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Deferred"}

{"bugzilla": {"description": "kernel: ixgbevf: fix mailbox API compatibility by negotiating supported features", "id": "2407348", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2407348"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.0", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "details": ["No description is available for this CVE."], "name": "CVE-2025-40104", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2025-10-30T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2025-40104\nhttps://nvd.nist.gov/vuln/detail/CVE-2025-40104\nhttps://lore.kernel.org/linux-cve-announce/2025103018-CVE-2025-40104-d5a7@gregkh/T"], "threat_severity": "Important"}

{"created": "2025-10-30T14:37:24.582636+00:00", "updated": "2025-10-30T14:37:24.582671+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}