CVE-2025-39853

In the Linux kernel, the following vulnerability has been resolved: i40e: Fix potential invalid access when MAC list is empty list_first_entry() never returns NULL - if the list is empty, it still returns a pointer to an invalid object, leading to potential invalid memory access when dereferenced. Fix this by using list_first_entry_or_null instead of list_first_entry.

CVSS 3.1

7.1CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

EPSS

0.2% chance of exploitation in the next 30 days; higher than 5% of CVEs (scores of 2026-10-25)

CWE

CWE-125

Published

2025-09-19

Modified

2026-10-19

Record from

the NVD, synced 2026-10-21

Affected

• debian:debian_linux
• linux:linux_kernel

References

• https://git.kernel.org/stable/c/1eadabcf5623f1237a539b16586b4ed8ac8dffcd
• https://git.kernel.org/stable/c/3c6fb929afa313d9d11f780451d113f73922fe5d
• https://git.kernel.org/stable/c/66e7cdbda74ee823ec2bf7b830ebd235c54f5ddf
• https://git.kernel.org/stable/c/971feafe157afac443027acdc235badc6838560b
• https://git.kernel.org/stable/c/9c21fc4cebd44dd21016c61261a683af390343f8

Check your stackJSON