Login Request a demo
High severity · published Sep 19, 2025
CVE-2025-39853
i40e: Fix potential invalid access when MAC list is empty
7.1
CVSS
0.2%
EPSS
No
On KEV
Description
In the Linux kernel, the following vulnerability has been resolved: i40e: Fix potential invalid access when MAC list is empty list_first_entry() never returns NULL - if the list is empty, it still returns a pointer to an invalid object, leading to potential invalid memory access when dereferenced. Fix this by using list_first_entry_or_null instead of list_first_entry.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 6% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
KE
Kernel · Linux
4.6 before 5.4.299; 5.5 before 5.10.243; 5.11 before 5.15.192; 5.16 before 6.1.151; 6.2 before 6.6.105; 6.7 before 6.12.46; +5 more · source: NVD
LI
Linux · Linux
e3219ce6a775468368fb270fae3eb82a6787b436 before 971feafe157afac443027acdc235badc6838560b; e3219ce6a775468368fb270fae3eb82a6787b436 before 3c6fb929afa313d9d11f780451d113f73922fe5d; e3219ce6a775468368fb270fae3eb82a6787b436 before 1eadabcf5623f1237a539b16586b4ed8ac8dffcd; e3219ce6a775468368fb270fae3eb82a6787b436 before e2a5e74879f9b494bbd66fa93f355feacde450c7; e3219ce6a775468368fb270fae3eb82a6787b436 before fb216d980fae6561c7c70af8ef826faf059c6515; e3219ce6a775468368fb270fae3eb82a6787b436 before 66e7cdbda74ee823ec2bf7b830ebd235c54f5ddf; +3 more · source: vendor
DL
Debian Linux · Debian
11.0 · source: NVD
RR
RUGGEDCOM RST2428P · Siemens
before V3.3 · source: CISA
SX
SCALANCE XC-300/XR-300/XC-400/XR-500WG/XR-500 family · Siemens
before V3.3 · source: CISA
SX
SCALANCE XCH328 · Siemens
before V3.3 · source: CISA
SX
SCALANCE XCM324 · Siemens
before V3.3 · source: CISA
SX
SCALANCE XCM328 · Siemens
before V3.3 · source: CISA
SX
SCALANCE XCM332 · Siemens
before V3.3 · source: CISA
SX
SCALANCE XRH334 (24 V DC, 8xFO, CC) · Siemens
before V3.3 · source: CISA
SX
SCALANCE XRM334 (230 V AC, 12xFO) · Siemens
before V3.3 · source: CISA
SX
SCALANCE XRM334 (230 V AC, 8xFO) · Siemens
before V3.3 · source: CISA
In the news
VulnerabilityHigh
Siemens SINEC OS
View CSAF Summary SINEC OS before V3.3 contains third-party components with multiple vulnerabilities. Siemens has released new versions for the affected products and recommends to update to the latest versions. The following versions of Siemens SINEC OS are affected: RUGGEDCOM RST2428P (6GK6242-6PA00) vers:intdot/<3.3 (CVE-2022-48174, CVE-2023-7256, CVE-2023-39810, CVE-2023-42363, CVE-2023-42364, CVE-2023-42365, CVE-2023-42366, CVE-2024-6197, CVE-2024-6874, CVE-2024-7264, CVE-2024-8006, CVE-2024-8096, CVE-2024-9681, CVE-2024-11053, CVE-2024-12718, CVE-2024-41996, CVE-2024-47619, CVE-2024-52533, CVE-2025-0167, CVE-2025-0665, CVE-2025-0725, CVE-2025-1390, CVE-2025-3360, CVE-2025-4138, CVE-2025-4330, CVE-2025-4373, CVE-2025-4435, CVE-2025-4516, CVE-2025-4517, CVE-2025-6141, CVE-2025-9086, CVE-2025-9230, CVE-2025-9231, CVE-2025-9232, CVE-2025-10148, CVE-2025-27587, CVE-2025-32433, CVE-2025-38084, CVE-2025-38085, CVE-2025-38086, CVE-2025-38345, CVE-2025-38350, CVE-2025-38498, CVE-2025-39839, CVE-2025-39841, CVE-2025-39846, CVE-2025-39853, CVE-2025-39860, CVE-2025-39864, CVE-2025-39865, CVE-2025-59375) SCALANCE XCH328 (6GK5328-4TS01-2EC2) vers:intdot/<3.3 (CVE-2022-48174, CVE-2023-7256, CVE-2023-39810, CVE-2023-42363, CVE-2023-42364, CVE-2023-42365, CVE-2023-42366, CVE-2024-6197, CVE-2024-6874, CVE-2024-7264, CVE-2024-8006, CVE-2024-8096, CVE-2024-9681, CVE-2024-11053, CVE-2024-12718, CVE-2024-41996, CVE-2024-47619, CVE-2024-52533, CVE-2025-0167, CVE-2025-0665...
CVE-2022-48174CVE-2023-7256CVE-2023-39810
Feb 12, 2026·CISA Advisories
Affected product
KE
Kernel
Linux
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-39853
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-39853
Patch
https://git.kernel.org/stable/c/1eadabcf5623f1237a539b16586b4ed8ac8dffcd
Patch
https://git.kernel.org/stable/c/3c6fb929afa313d9d11f780451d113f73922fe5d
Patch
https://git.kernel.org/stable/c/66e7cdbda74ee823ec2bf7b830ebd235c54f5ddf
Patch
https://git.kernel.org/stable/c/971feafe157afac443027acdc235badc6838560b
Patch
https://git.kernel.org/stable/c/9c21fc4cebd44dd21016c61261a683af390343f8
Patch
https://git.kernel.org/stable/c/a556f06338e1d5a85af0e32ecb46e365547f92b9
More from Kernel
9.8
CVE-2025-39682
tls: fix handling of zero-length records on the rx_list
8.8
CVE-2026-53266
netfilter: bridge: make ebt_snat ARP rewrite writable
8.8
CVE-2013-6282
Linux Kernel Improper Input Validation Vulnerability
8.4
CVE-2022-0185
Linux Kernel Heap-Based Buffer Overflow Vulnerability
8.4
CVE-2013-2094
Linux Kernel Privilege Escalation Vulnerability