Description
In the Linux kernel, the following vulnerability has been resolved:
i40e: Do not allow untrusted VF to remove administratively set MAC
Currently when PF administratively sets VF's MAC address and the VF
is put down (VF tries to delete all MACs) then the MAC is removed
from MAC filters and primary VF MAC is zeroed.
Do not allow untrusted VF to remove primary MAC when it was set
administratively by PF.
Reproducer:
1) Create VF
2) Set VF interface up
3) Administratively set the VF's MAC
4) Put VF interface down
[root@host ~]# echo 1 > /sys/class/net/enp2s0f0/device/sriov_numvfs
[root@host ~]# ip link set enp2s0f0v0 up
[root@host ~]# ip link set enp2s0f0 vf 0 mac fe:6c:b5:da:c7:7d
[root@host ~]# ip link show enp2s0f0
23: enp2s0f0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP mode DEFAULT group default qlen 1000
link/ether 3c:ec:ef:b7:dd:04 brd ff:ff:ff:ff:ff:ff
vf 0 link/ether fe:6c:b5:da:c7:7d brd ff:ff:ff:ff:ff:ff, spoof checking on, link-state auto, trust off
[root@host ~]# ip link set enp2s0f0v0 down
[root@host ~]# ip link show enp2s0f0
23: enp2s0f0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP mode DEFAULT group default qlen 1000
link/ether 3c:ec:ef:b7:dd:04 brd ff:ff:ff:ff:ff:ff
vf 0 link/ether 00:00:00:00:00:00 brd ff:ff:ff:ff:ff:ff, spoof checking on, link-state auto, trust off
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Linux | Linux | 3.14 | 6.1.79 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | linux | 6.7.7-1 | — |
| Debian 13 | linux | 6.7.7-1 | — |
| Debian 12 | linux | 6.1.82-1 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Nvidia-BlueField 22.04 LTS | linux-bluefield | 5.15.0-1051.53 | — |
| Ubuntu 22.04 LTS | linux +1 | 5.15.0-119.129 | USN-6974-1 |
| Ubuntu 22.04 LTS | linux-aws | 5.15.0-1068.74 | USN-6974-1 |
| Ubuntu 22.04 LTS | linux-aws-6.5 | 6.5.0-1023.23~22.04.1 | USN-6895-3 |
| Ubuntu 22.04 LTS | linux-azure | 5.15.0-1071.80 | USN-6974-1 |
| Ubuntu 22.04 LTS | linux-azure-6.5 | 6.5.0-1024.25~22.04.1 | USN-6895-2 |
| Ubuntu 22.04 LTS | linux-azure-fde | 5.15.0-1071.80.1 | USN-6974-1 |
| Ubuntu 22.04 LTS | linux-gcp | 5.15.0-1067.75 | USN-6974-1 |
| Ubuntu 22.04 LTS | linux-gcp-6.5 | 6.5.0-1024.26~22.04.1 | USN-6895-2 |
| Ubuntu 22.04 LTS | linux-gke | 5.15.0-1065.71 | USN-6974-1 |
| Ubuntu 22.04 LTS | linux-gkeop | 5.15.0-1051.58 | USN-6974-1 |
| Ubuntu 22.04 LTS | linux-hwe-6.5 | 6.5.0-44.44~22.04.1 | USN-6900-1 |
| Ubuntu 22.04 LTS | linux-ibm +1 | 5.15.0-1061.64 | USN-6974-1 |
| Ubuntu 22.04 LTS | linux-intel-iotg | 5.15.0-1063.69 | USN-6974-1 |
| Ubuntu 22.04 LTS | linux-kvm | 5.15.0-1065.70 | USN-6974-1 |
| Ubuntu 22.04 LTS | linux-lowlatency-hwe-6.5 | 6.5.0-44.44.1~22.04.1 | USN-6895-3 |
| Ubuntu 22.04 LTS | linux-nvidia | 5.15.0-1063.64 | USN-6974-1 |
| Ubuntu 22.04 LTS | linux-nvidia-6.5 | 6.5.0-1023.24 | USN-6895-1 |
| Ubuntu 22.04 LTS | linux-nvidia-tegra | 5.15.0-1028.28 | — |
| Ubuntu 22.04 LTS | linux-nvidia-tegra-igx | 5.15.0-1016.16 | — |
| Ubuntu 22.04 LTS | linux-oem-6.5 | 6.5.0-1027.28 | USN-6895-4 |
| Ubuntu 22.04 LTS | linux-oracle | 5.15.0-1066.72 | USN-6974-1 |
| Ubuntu 22.04 LTS | linux-oracle-6.5 | 6.5.0-1026.26~22.04.1 | USN-6895-3 |
| Ubuntu 22.04 LTS | linux-riscv +22 | No fix yet | — |
| Ubuntu 22.04 LTS | linux-starfive-6.5 | 6.5.0-1017.18~22.04.1 | USN-6895-3 |
| Ubuntu 22.04 LTS | linux-xilinx-zynqmp | 5.15.0-1035.39 | USN-7019-1 |
| Ubuntu 20.04 LTS | linux | 5.4.0-193.213 | USN-6973-1 |
| Ubuntu 20.04 LTS | linux-aws | 5.4.0-1131.141 | USN-6973-1 |
| Ubuntu 20.04 LTS | linux-aws-5.15 | 5.15.0-1068.74~20.04.1 | USN-6974-1 |
| Ubuntu 20.04 LTS | linux-azure | 5.4.0-1136.143 | USN-6973-1 |
| Ubuntu 20.04 LTS | linux-azure-5.15 | 5.15.0-1071.80~20.04.1 | USN-6974-1 |
| Ubuntu 20.04 LTS | linux-azure-fde-5.15 | 5.15.0-1071.80~20.04.1.1 | USN-6974-1 |
| Ubuntu 20.04 LTS | linux-bluefield | 5.4.0-1091.98 | USN-6973-1 |
| Ubuntu 20.04 LTS | linux-gcp | 5.4.0-1135.144 | USN-6973-1 |
| Ubuntu 20.04 LTS | linux-gcp-5.15 | 5.15.0-1067.75~20.04.1 | USN-6974-1 |
| Ubuntu 20.04 LTS | linux-gke +26 | No fix yet | — |
| Ubuntu 20.04 LTS | linux-gkeop | 5.4.0-1098.102 | USN-6973-1 |
| Ubuntu 20.04 LTS | linux-gkeop-5.15 | 5.15.0-1051.58~20.04.1 | USN-6974-1 |
| Ubuntu 20.04 LTS | linux-hwe-5.15 +1 | 5.15.0-119.129~20.04.1 | USN-6974-1 |
| Ubuntu 20.04 LTS | linux-ibm | 5.4.0-1078.83 | USN-6973-1 |
| Ubuntu 20.04 LTS | linux-ibm-5.15 | 5.15.0-1061.64~20.04.1 | USN-6974-1 |
| Ubuntu 20.04 LTS | linux-intel-iotg-5.15 | 5.15.0-1063.69~20.04.1 | USN-6974-1 |
| Ubuntu 20.04 LTS | linux-iot | 5.4.0-1043.44 | USN-7006-1 |
| Ubuntu 20.04 LTS | linux-kvm | 5.4.0-1119.127 | USN-6973-1 |
| Ubuntu 20.04 LTS | linux-nvidia-tegra-5.15 | 5.15.0-1030.30~20.04.1 | — |
| Ubuntu 20.04 LTS | linux-oracle | 5.4.0-1130.139 | USN-6973-1 |
| Ubuntu 20.04 LTS | linux-oracle-5.15 | 5.15.0-1066.72~20.04.1 | USN-6974-2 |
| Ubuntu 20.04 LTS | linux-raspi | 5.4.0-1115.127 | USN-6973-1 |
| Ubuntu 20.04 LTS | linux-riscv-5.15 | 5.15.0-1064.68~20.04.1 | — |
| Ubuntu 20.04 LTS | linux-xilinx-zynqmp | 5.4.0-1050.54 | USN-6973-1 |
| Ubuntu 18.04 LTS | linux-gcp +14 | No fix yet | — |
| Ubuntu 16.04 LTS | linux-hwe-edge | No fix yet | — |
Show 13 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro Realtime 24.04 LTS | linux-raspi-realtime | 6.8.0-2002.2 | — |
| Ubuntu Pro Realtime 22.04 LTS | linux-intel-iot-realtime | 5.15.0-1061.63 | — |
| Ubuntu Pro Realtime 22.04 LTS | linux-realtime | 5.15.0-1069.77 | — |
| Ubuntu Pro FIPS 20.04 LTS | linux-fips +3 | No fix yet | — |
| Ubuntu Pro FIPS 18.04 LTS | linux-fips +3 | No fix yet | — |
| Ubuntu Pro FIPS 16.04 LTS | linux-fips | No fix yet | — |
| Ubuntu Pro FIPS-updates 22.04 LTS | linux-aws-fips | 5.15.0-1068.74+fips1 | — |
| Ubuntu Pro FIPS-updates 22.04 LTS | linux-azure-fips | 5.15.0-1071.80+fips1 | — |
| Ubuntu Pro FIPS-updates 22.04 LTS | linux-fips | 5.15.0-119.129+fips1 | — |
| Ubuntu Pro FIPS-updates 22.04 LTS | linux-gcp-fips | 5.15.0-1067.75+fips1 | — |
| Ubuntu Pro FIPS-updates 20.04 LTS | linux-aws-fips | 5.4.0-1131.141+fips1 | — |
| Ubuntu Pro FIPS-updates 20.04 LTS | linux-azure-fips | 5.4.0-1136.143+fips1 | — |
| Ubuntu Pro FIPS-updates 20.04 LTS | linux-fips | 5.4.0-1105.115 | — |
| Ubuntu Pro FIPS-updates 20.04 LTS | linux-gcp-fips | 5.4.0-1135.144+fips1 | — |
| Ubuntu Pro FIPS-updates 18.04 LTS | linux-fips +3 | No fix yet | — |
| Ubuntu Pro FIPS-updates 16.04 LTS | linux-fips | No fix yet | — |
| Ubuntu Pro FIPS-preview 22.04 LTS | linux-fips +3 | No fix yet | — |
| Ubuntu Pro 18.04 LTS | linux +5 | No fix yet | — |
| Ubuntu Pro 18.04 LTS | linux-aws-5.4 | 5.4.0-1131.141~18.04.1 | USN-6973-3 |
| Ubuntu Pro 18.04 LTS | linux-azure-5.4 | 5.4.0-1136.143~18.04.1 | USN-6973-2 |
| Ubuntu Pro 18.04 LTS | linux-gcp-5.4 | 5.4.0-1135.144~18.04.1 | USN-6973-1 |
| Ubuntu Pro 18.04 LTS | linux-hwe-5.4 | 5.4.0-193.213~18.04.1 | USN-6973-1 |
| Ubuntu Pro 18.04 LTS | linux-ibm-5.4 | 5.4.0-1078.83~18.04.1 | USN-6973-1 |
| Ubuntu Pro 18.04 LTS | linux-oracle-5.4 | 5.4.0-1130.139~18.04.1 | USN-6973-1 |
| Ubuntu Pro 18.04 LTS | linux-raspi-5.4 | 5.4.0-1115.127~18.04.1 | USN-6973-4 |
| Ubuntu Pro 16.04 LTS | linux +7 | No fix yet | — |
| Ubuntu Pro 14.04 LTS | linux +3 | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 9 | bpftool | 7.3.0-427.13.1.el9_4 | RHSA-2024:2394 |
| RHEL 9 | rv +64 | 5.14.0-427.13.1.el9_4 | RHSA-2024:2394 |
| RHEL 8 | perf +26 | 4.18.0-553.el8_10 | RHSA-2024:3138 |
Show 5 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 9.2 EUS | bpftool | 7.0.0-284.99.1.el9_2 | RHSA-2025:0063 |
| RHEL 9.2 EUS | kernel-rt +14 | 5.14.0-284.99.1.rt14.384.el9_2 | RHSA-2025:0064 |
| RHEL 9.2 EUS | perf +47 | 5.14.0-284.99.1.el9_2 | RHSA-2025:0063 |
| RHEL 8.8 EUS | perf +26 | 4.18.0-477.83.1.el8_8 | RHSA-2024:10941 |
| RHEL 8.6 TUS | perf +17 | 4.18.0-372.126.1.el8_6 | RHSA-2024:8161 |
| RHEL 8.6 E4S | perf +25 | 4.18.0-372.126.1.el8_6 | RHSA-2024:8161 |
| RHEL 8.6 AUS | perf +17 | 4.18.0-372.126.1.el8_6 | RHSA-2024:8161 |
Rocky Linux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Rocky Linux 8 | kernel | 4.18.0-553.123.1.el8_10.cloud.0.1 | RXSA-2024:3138 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP5 | kernel-64kb +5 | 5.14.21-150500.55.62.2 | SUSE-SU-2024:1659-1 |
| SLES 15 SP5 | kernel-azure +2 | 5.14.21-150500.33.51.1 | SUSE-SU-2024:1644-1 |
| SLES 15 SP5 | kernel-default-base | 5.14.21-150500.55.62.2.150500.6.27.2 | SUSE-SU-2024:1659-1 |
| SLES 15 SP5 | kernel-syms | 5.14.21-150500.55.62.1 | SUSE-SU-2024:1659-1 |
| SLES 12 SP5 | kernel-azure +2 | 4.12.14-16.194.1 | SUSE-SU-2024:2901-1 |
| SLES 12 SP5 | kernel-docs | 4.12.14-122.225.2 | SUSE-SU-2024:2940-1 |
| SLES 12 SP5 | kernel-syms +3 | 4.12.14-122.225.1 | SUSE-SU-2024:2940-1 |
Show 6 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES for SAP 12 SP5 | kernel-azure +2 | 4.12.14-16.194.1 | SUSE-SU-2024:2901-1 |
| SLES for SAP 12 SP5 | kernel-syms +2 | 4.12.14-122.225.1 | SUSE-SU-2024:2940-1 |
| SLE Real Time 12 SP5 | kernel-rt +3 | 4.12.14-10.197.1 | SUSE-SU-2024:2892-1 |
| SLE Micro 5.5 | kernel-default | 5.14.21-150500.55.62.2 | SUSE-SU-2024:1659-1 |
| SLE Micro 5.5 | kernel-default-base | 5.14.21-150500.55.62.2.150500.6.27.2 | SUSE-SU-2024:1659-1 |
| SLE Micro 5.5 | kernel-rt +1 | 5.14.21-150500.13.52.1 | SUSE-SU-2024:1663-1 |
| SLE Live Patching 15 SP5 | kernel-default | 5.14.21-150500.55.62.2 | SUSE-SU-2024:1659-1 |
| SLE Live Patching 15 SP5 | kernel-livepatch-SLE15-SP5-RT_Update_14 | 1-150500.11.5.1 | SUSE-SU-2024:1663-1 |
| SLE Live Patching 15 SP5 | kernel-livepatch-SLE15-SP5_Update_13 | 1-150500.11.3.2 | SUSE-SU-2024:1659-1 |
| SLE Live Patching 12 SP5 | kernel-default | 4.12.14-122.225.1 | SUSE-SU-2024:2940-1 |
| SLE Live Patching 12 SP5 | kgraft-patch-SLE12-SP5_Update_59 | 1-8.3.1 | SUSE-SU-2024:2940-1 |
| SUSE Real Time Module 15 SP5 | kernel-rt +3 | 5.14.21-150500.13.52.1 | SUSE-SU-2024:1663-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Leap 15.5 | dtb-aarch64 +2 | 5.14.21-150500.55.62.1 | SUSE-SU-2024:1659-1 |
| openSUSE Leap 15.5 | kernel-64kb +7 | 5.14.21-150500.55.62.2 | SUSE-SU-2024:1659-1 |
| openSUSE Leap 15.5 | kernel-azure +2 | 5.14.21-150500.33.51.1 | SUSE-SU-2024:1644-1 |
| openSUSE Leap 15.5 | kernel-default-base | 5.14.21-150500.55.62.2.150500.6.27.2 | SUSE-SU-2024:1659-1 |
| openSUSE Leap 15.5 | kernel-rt +3 | 5.14.21-150500.13.52.1 | SUSE-SU-2024:1663-1 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 2 (CBL-Mariner) | kernel | No fix yet | — |
Advisories 27
- USN-7006-1 linux-iot vulnerabilities Ubuntu Security Notices (USN) · Oct 26, 2026
- USN-7019-1 linux-xilinx-zynqmp vulnerabilities Ubuntu Security Notices (USN) · Oct 26, 2026
- USN-6895-3 linux-aws-6.5, linux-lowlatency-hwe-6.5, linux-oracle-6.5, linux-starfive-6.5 vulnerabilities Ubuntu Security Notices (USN) · Oct 23, 2026
- USN-6900-1 linux-hwe-6.5 vulnerabilities Ubuntu Security Notices (USN) · Oct 23, 2026
- USN-6974-2 linux-oracle-5.15 vulnerabilities Ubuntu Security Notices (USN) · Oct 23, 2026
- USN-6895-2 linux-azure-6.5, linux-gcp-6.5 vulnerabilities Ubuntu Security Notices (USN) · Oct 23, 2026
- USN-6973-1 linux, linux-aws, linux-azure, linux-bluefield, linux-gcp, linux-gcp-5.4, linux-gkeop, linux-hwe-5.4, linux-ibm, linux-ibm-5.4, linux-kvm, linux-oracle, linux-oracle-5.4, linux-raspi, linux-xilinx-zynqmp vulnerabilities Ubuntu Security Notices (USN) · Oct 23, 2026
- USN-6973-2 linux-azure-5.4 vulnerabilities Ubuntu Security Notices (USN) · Oct 23, 2026
- USN-6974-1 linux, linux-aws, linux-aws-5.15, linux-azure, linux-azure-5.15, linux-azure-fde, linux-azure-fde-5.15, linux-gcp, linux-gcp-5.15, linux-gke, linux-gkeop, linux-gkeop-5.15, linux-hwe-5.15, linux-ibm, linux-ibm-5.15, linux-intel-iotg, linux-intel-iotg-5.15, linux-kvm, linux-lowlatency, linux-lowlatency-hwe-5.15, linux-nvidia, linux-oracle, linux-raspi vulnerabilities Ubuntu Security Notices (USN) · Oct 23, 2026
- USN-6973-4 linux-raspi-5.4 vulnerabilities Ubuntu Security Notices (USN) · Oct 23, 2026
- USN-6973-3 linux-aws-5.4 vulnerabilities Ubuntu Security Notices (USN) · Oct 23, 2026
- USN-6895-1 linux, linux-gcp, linux-nvidia-6.5, linux-raspi vulnerabilities Ubuntu Security Notices (USN) · Oct 23, 2026
- USN-6895-4 linux-oem-6.5 vulnerabilities Ubuntu Security Notices (USN) · Oct 23, 2026
- RHSA-2024:3138 Red Hat Security Advisory: kernel security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Oct 17, 2026
- RHSA-2024:2394 Red Hat Security Advisory: kernel security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Oct 17, 2026
- RHSA-2024:10941 Red Hat Security Advisory: kernel security update Red Hat Security Advisories (RHSA) · Sep 13, 2026
- RHSA-2025:0063 Red Hat Security Advisory: kernel security update Red Hat Security Advisories (RHSA) · Aug 5, 2026
- RHSA-2025:0064 Red Hat Security Advisory: kernel-rt security update Red Hat Security Advisories (RHSA) · Aug 5, 2026
- RHSA-2024:8161 Red Hat Security Advisory: kernel security update Red Hat Security Advisories (RHSA) · Aug 5, 2026
- RXSA-2024:3138 Moderate: kernel security, bug fix, and enhancement update Rocky Linux Security Advisories · May 29, 2026
- WID-SEC-2024-0913 Linux Kernel: Mehrere Schwachstellen ermöglichen Denial of Service BSI CERT-Bund (WID) · Mar 31, 2026
- SUSE-SU-2024:2892-1 Security update for the Linux Kernel SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2024:2940-1 Security update for the Linux Kernel SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2024:1663-1 Security update for the Linux Kernel SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2024:2901-1 Security update for the Linux Kernel SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2024:1644-1 Security update for the Linux Kernel SUSE / openSUSE Security Updates · May 2, 2025
- SUSE-SU-2024:1659-1 Security update for the Linux Kernel SUSE / openSUSE Security Updates · May 2, 2025