{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2025-40104", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2025-04-16T07:20:57.165Z", "datePublished": "2025-10-30T09:48:09.051Z", "dateUpdated": "2026-08-05T12:07:49.716Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:07:49.716Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nixgbevf: fix mailbox API compatibility by negotiating supported features\n\nThere was backward compatibility in the terms of mailbox API. Various\ndrivers from various OSes supporting 10G adapters from Intel portfolio\ncould easily negotiate mailbox API.\n\nThis convention has been broken since introducing API 1.4.\nCommit 0062e7cc955e (\"ixgbevf: add VF IPsec offload code\") added support\nfor IPSec which is specific only for the kernel ixgbe driver. None of the\nrest of the Intel 10G PF/VF drivers supports it. And actually lack of\nsupport was not included in the IPSec implementation - there were no such\ncode paths. No possibility to negotiate support for the feature was\nintroduced along with introduction of the feature itself.\n\nCommit 339f28964147 (\"ixgbevf: Add support for new mailbox communication\nbetween PF and VF\") increasing API version to 1.5 did the same - it\nintroduced code supported specifically by the PF ESX driver. It altered API\nversion for the VF driver in the same time not touching the version\ndefined for the PF ixgbe driver. It led to additional discrepancies,\nas the code provided within API 1.6 cannot be supported for Linux ixgbe\ndriver as it causes crashes.\n\nThe issue was noticed some time ago and mitigated by Jake within the commit\nd0725312adf5 (\"ixgbevf: stop attempting IPSEC offload on Mailbox API 1.5\").\nAs a result we have regression for IPsec support and after increasing API\nto version 1.6 ixgbevf driver stopped to support ESX MBX.\n\nTo fix this mess add new mailbox op asking PF driver about supported\nfeatures. Basing on a response determine whether to set support for IPSec\nand ESX-specific enhanced mailbox.\n\nNew mailbox op, for compatibility purposes, must be added within new API\nrevision, as API version of OOT PF & VF drivers is already increased to\n1.6 and doesn't incorporate features negotiate op.\n\nFeatures negotiation mechanism gives possibility to be extended with new\nfeatures when needed in the future." } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:L - The defect is exercised entirely through the local PCIe PF/VF mailbox during `ixgbevf_probe()`/`ixgbevf_reset()` and through the local xfrm netlink offload path (`xdo_dev_state_add`); no remote or adjacent-network peer data reaches the vulnerable negotiation logic.\nAC:L - On any host whose PF is not the Linux `ixgbe` driver (VMware ESXi, Windows, FreeBSD, or Intel's OOT PF — all of which accept API 1.4/1.5/1.6), the wrong feature set is selected deterministically on every single driver load with no race, timing window, or memory-layout dependency, and it can be re-triggered indefinitely via link down/up.\nPR:L - SR-IOV VFs are routinely delegated into container/VM network namespaces (sriov-cni and friends), and `xfrm_user_rcv_msg()` gates SA creation on `netlink_net_capable(CAP_NET_ADMIN)`, i.e. `ns_capable()` against the netns' owning user namespace — so an otherwise-unprivileged account that owns a userns holding the VF can drive `ixgbevf_ipsec_add_sa()` and repeated `ixgbevf_reset()`/renegotiation.\nUI:N - The mismatched feature state is established automatically during driver bring-up and every subsequent reset, and the IPsec SA installation is performed by the attacker themselves; no action by any other user is required.\nS:U - Both the defect and its consequences are confined to the kernel running `ixgbevf` on the VF side; no hypervisor, IOMMU, or sandbox boundary is crossed, since the PF is the peer that the VF misjudges rather than the victim.\nC:H - Because the VF advertises `NETIF_F_HW_ESP` against a PF with no IPsec implementation, `ixgbevf_ipsec_set_pf_sa()` ships the raw AES-GCM key and SA parameters to a peer never negotiated to handle message 0x0e and marks the SA hardware-offloaded on any non-FAILURE reply, after which `esp_xmit()` skips software encryption — the full plaintext of the supposedly ESP-protected traffic leaves on the wire, and cryptographic key material is disclosed to an unnegotiated consumer.\nI:H - The same false offload claim removes ESP integrity protection from transmitted traffic while `ixgbevf_ipsec_rx()` stamps `CRYPTO_DONE`/`CRYPTO_SUCCESS` on frames whose ICV was never verified in hardware, so the stack accepts and forwards unauthenticated data as if it had passed IPsec verification.\nA:H - The commit states outright that the version-only feature selection \"causes crashes\" when the API-1.6 code paths run against the Linux `ixgbe` PF, and the mismatched ESX mailbox plus the wrongly latched `mac->get_link_status = false` in `ixgbevf_check_mac_link_vf()` desynchronize PF/VF communication and permanently wedge the VF's link state, leaving the interface dead." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/net/ethernet/intel/ixgbevf/ipsec.c", "drivers/net/ethernet/intel/ixgbevf/ixgbevf.h", "drivers/net/ethernet/intel/ixgbevf/ixgbevf_main.c", "drivers/net/ethernet/intel/ixgbevf/mbx.h", "drivers/net/ethernet/intel/ixgbevf/vf.c", "drivers/net/ethernet/intel/ixgbevf/vf.h" ], "versions": [ { "version": "0062e7cc955e0827a88570ed36ea511a7dcb391e", "lessThan": "871ac1cd4ce4804defcb428cbb003fd84c415ff4", "status": "affected", "versionType": "git" }, { "version": "0062e7cc955e0827a88570ed36ea511a7dcb391e", "lessThan": "2e0aab9ddaf1428602c78f12064cd1e6ffcc4d18", "status": "affected", "versionType": "git" }, { "version": "0062e7cc955e0827a88570ed36ea511a7dcb391e", "lessThan": "bf580112ed61736c2645a893413a04732505d4b1", "status": "affected", "versionType": "git" }, { "version": "0062e7cc955e0827a88570ed36ea511a7dcb391e", "lessThan": "a376e29b1b196dc90b50df7e5e3947e3026300c4", "status": "affected", "versionType": "git" }, { "version": "0062e7cc955e0827a88570ed36ea511a7dcb391e", "lessThan": "a7075f501bd33c93570af759b6f4302ef0175168", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/net/ethernet/intel/ixgbevf/ipsec.c", "drivers/net/ethernet/intel/ixgbevf/ixgbevf.h", "drivers/net/ethernet/intel/ixgbevf/ixgbevf_main.c", "drivers/net/ethernet/intel/ixgbevf/mbx.h", "drivers/net/ethernet/intel/ixgbevf/vf.c", "drivers/net/ethernet/intel/ixgbevf/vf.h" ], "versions": [ { "version": "4.20", "status": "affected" }, { "version": "0", "lessThan": "4.20", "status": "unaffected", "versionType": "semver" }, { "version": "6.1.158", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.6.114", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.12.55", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.17.5", "lessThanOrEqual": "6.17.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.18", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.20", "versionEndExcluding": "6.1.158" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.20", "versionEndExcluding": "6.6.114" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.20", "versionEndExcluding": "6.12.55" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.20", "versionEndExcluding": "6.17.5" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.20", "versionEndExcluding": "6.18" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/871ac1cd4ce4804defcb428cbb003fd84c415ff4" }, { "url": "https://git.kernel.org/stable/c/2e0aab9ddaf1428602c78f12064cd1e6ffcc4d18" }, { "url": "https://git.kernel.org/stable/c/bf580112ed61736c2645a893413a04732505d4b1" }, { "url": "https://git.kernel.org/stable/c/a376e29b1b196dc90b50df7e5e3947e3026300c4" }, { "url": "https://git.kernel.org/stable/c/a7075f501bd33c93570af759b6f4302ef0175168" } ], "title": "ixgbevf: fix mailbox API compatibility by negotiating supported features", "x_generator": { "engine": "bippy-1.2.0" } } } }