CVE-2025-40104

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

ixgbevf: fix mailbox API compatibility by negotiating supported features

There was backward compatibility in the terms of mailbox API. Various

drivers from various OSes supporting 10G adapters from Intel portfolio

could easily negotiate mailbox API.

This convention has been broken since introducing API 1.4.

Commit 0062e7cc955e ("ixgbevf: add VF IPsec offload code") added support

for IPSec which is specific only for the kernel ixgbe driver. None of the

rest of the Intel 10G PF/VF drivers supports it. And actually lack of

support was not included in the IPSec implementation - there were no such

code paths. No possibility to negotiate support for the feature was

introduced along with introduction of the feature itself.

Commit 339f28964147 ("ixgbevf: Add support for new mailbox communication

between PF and VF") increasing API version to 1.5 did the same - it

introduced code supported specifically by the PF ESX driver.

Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

References