Compatibility Issue in Linux Kernel's Mailbox API for Intel 10G Adapters
Summary
DEBIAN-CVE-2025-40104: In the Linux kernel, the following vulnerability has been resolved: ixgbevf: fix mailbox API compatibility by negotiating supported features There was backward compatibility in the terms of mailbox API. Affects linux versions 5.10.103-1 – 6.9.9-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is a core component of many operating systems, providing essential services and functionalities. It supports a wide range of hardware, including Intel's 10G network adapters. The kernel's mailbox API facilitates communication between different drivers, ensuring compatibility and functionality across various operating systems. However, recent changes have introduced compatibility issues that affect the performance and stability of these drivers.
Vulnerability Detail
In the Linux kernel, a vulnerability has been identified in the ixgbevf driver related to the mailbox API. The introduction of API version 1.4 broke backward compatibility, particularly with the addition of IPSec support, which is not universally supported across all Intel 10G drivers. This inconsistency can lead to crashes and a lack of functionality when negotiating supported features between the PF and VF drivers. The issue stems from the failure to include necessary code paths for feature negotiation, resulting in a regression for IPSec support and compatibility problems with ESX mailbox communication.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can avoid using the IPSec offload feature until the kernel is updated. This can be done by modifying the driver settings to disable IPSec support, which can prevent crashes associated with the incompatible mailbox API.
Conclusion
The identified vulnerability in the Linux kernel's mailbox API for Intel 10G adapters poses significant risks to system stability and functionality. Users are advised to update their kernel to the latest patched version to mitigate these risks. In the meantime, disabling certain features can serve as a temporary workaround.
See every vulnerability recorded for linux →
FAQ
The vulnerability can lead to crashes and instability in systems using Intel 10G adapters, particularly when negotiating mailbox API features.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
If an immediate update is not possible, consider disabling the IPSec offload feature as a temporary workaround to maintain system stability.
Yes, the vulnerability affects multiple versions of the Linux kernel that include the ixgbevf driver and the mailbox API changes.
Detailed information can be found in the Debian security advisory and the official Linux kernel documentation.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
