In the Linux kernel, the following vulnerability has been resolved: i40e: add validation for ring_len param The `ring_len` parameter provided by the virtual function (VF) is assigned directly to the hardware memory context (HMC) without any validation. To address this, introduce an upper boundary check for both Tx and Rx queue lengths. The maximum number of descriptors supported by the hardware is 8k-32. Additionally, enforce alignment constraints: Tx rings must be a multiple of 8, and Rx rings must be a multiple of 32.

The remote Oracle Linux 8 / 9 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2025-25733 advisory.

    - i40e: add validation for ring_len param (Lukasz Czapnik)  [Orabug: 38603025]  {CVE-2025-39973}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 7 / 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2025-25731 advisory.

    - i40e: add validation for ring_len param (Lukasz Czapnik)  [Orabug: 38604168]  {CVE-2025-39973}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of kernel installed on the remote host is prior to 5.10.245-241.976. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.10-2025-109 advisory.

    In the Linux kernel, the following vulnerability has been resolved:

    netdevsim: fix memory leak in nsim_drv_probe() when nsim_dev_resources_register() failed (CVE-2022-50500)

    In the Linux kernel, the following vulnerability has been resolved:

    scsi: qla2xxx: Use raw_smp_processor_id() instead of smp_processor_id() (CVE-2023-53530)

    In the Linux kernel, the following vulnerability has been resolved:

    net: bridge: fix soft lockup in br_multicast_query_expired() (CVE-2025-39773)

    In the Linux kernel, the following vulnerability has been resolved:

    mm/memory-failure: fix VM_BUG_ON_PAGE(PagePoisoned(page)) when unpoison memory (CVE-2025-39883)

    In the Linux kernel, the following vulnerability has been resolved:

    i40e: fix IRQ freeing in i40e_vsi_request_irq_msix error path (CVE-2025-39911)

    In the Linux kernel, the following vulnerability has been resolved:

    tcp_bpf: Call sk_msg_free() when tcp_bpf_send_verdict() fails to allocate psock->cork. (CVE-2025-39913)

    In the Linux kernel, the following vulnerability has been resolved:

    net: rfkill: gpio: Fix crash due to dereferencering uninitialized pointer (CVE-2025-39937)

    In the Linux kernel, the following vulnerability has been resolved:

    qed: Don't collect too many protection override GRC elements (CVE-2025-39949)

    In the Linux kernel, the following vulnerability has been resolved:

    cgroup: split cgroup_destroy_wq into 3 workqueues (CVE-2025-39953)

    In the Linux kernel, the following vulnerability has been resolved:

    tcp: Clear tcp_sk(sk)->fastopen_rsk in tcp_disconnect(). (CVE-2025-39955)

    In the Linux kernel, the following vulnerability has been resolved:

    crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CVE-2025-39964)

    In the Linux kernel, the following vulnerability has been resolved:

    i40e: add max boundary check for VF filters (CVE-2025-39968)

    In the Linux kernel, the following vulnerability has been resolved:

    i40e: fix input validation logic for action_meta (CVE-2025-39970)

    In the Linux kernel, the following vulnerability has been resolved:

    i40e: fix idx validation in i40e_validate_queue_map (CVE-2025-39972)

    In the Linux kernel, the following vulnerability has been resolved:

    i40e: add validation for ring_len param (CVE-2025-39973)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - i40e: add validation for ring_len param The `ring_len` parameter provided by the virtual function (VF) is     assigned directly to the hardware memory context (HMC) without any validation. To address this, introduce     an upper boundary check for both Tx and Rx queue lengths. The maximum number of descriptors supported by     the hardware is 8k-32. Additionally, enforce alignment constraints: Tx rings must be a multiple of 8, and     Rx rings must be a multiple of 32. (CVE-2025-39973)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote Oracle Linux 10 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2025-20719 advisory.

    - io_uring/futex: ensure io_futex_wait() cleans up properly on failure (Jens Axboe)  [Orabug: 38572958]     {CVE-2025-39698}
    - fs: writeback: fix use-after-free in __mark_inode_dirty() (Jiufei Xue)  [Orabug: 38572953]     {CVE-2025-39866}
    - kernfs: Fix UAF in polling when open file is released (Chen Ridong)  [Orabug: 38572951]  {CVE-2025-3988}
    - vsock/virtio: Validate length in packet header before skb_put() (Will Deacon)  [Orabug: 38572950]     {CVE-2025-39718}
    - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (Herbert Xu)  [Orabug: 38572948]     {CVE-2025-39964}
    - io_uring: fix incorrect io_kiocb reference in io_link_skb (Yang Xiuwei)  [Orabug: 38572947]     {CVE-2025-39963}
    - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca)  [Orabug: 38572946]  {CVE-2025-39965}
    - tls: make sure to abort the stream if headers are bogus (Jakub Kicinski)  [Orabug: 38572944]     {CVE-2025-39946}
    - futex: Prevent use-after-free during requeue-PI (Sebastian Andrzej Siewior)  [Orabug: 38572943]     {CVE-2025-39977}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
272266	Oracle Linux 8 / 9 : Unbreakable Enterprise kernel (ELSA-2025-25733)	Nessus	Oracle Linux Local Security Checks	high
272200	Oracle Linux 7 / 8 : Unbreakable Enterprise kernel (ELSA-2025-25731)	Nessus	Oracle Linux Local Security Checks	high
271760	Amazon Linux 2 : kernel, --advisory ALAS2KERNEL-5.10-2025-109 (ALASKERNEL-5.10-2025-109)	Nessus	Amazon Linux Local Security Checks	high
271527	Linux Distros Unpatched Vulnerability : CVE-2025-39973	Nessus	Misc.	critical
271415	Oracle Linux 10 / 9 : Unbreakable Enterprise kernel (ELSA-2025-20719)	Nessus	Oracle Linux Local Security Checks	high

Detections

Analytics

CVE-2025-39973

high

Tenable Plugins

high

high

high

critical

high