CVE-2025-39875: 
Linux Kernel vulnerability analysis and mitigation

A vulnerability in the Linux kernel's igb driver has been identified and assigned CVE-2025-39875. The issue was discovered and published to the CVE List on September 23, 2025. The vulnerability affects the Intel Gigabit Ethernet driver (igb) implementation in the Linux kernel, specifically during the execution of ethtool loopback tests (NVD CVE).

The vulnerability manifests as a NULL pointer dereference in the igb driver during ethtool loopback test execution. The issue occurs because there is no associated qvector for the test ring when it is set up, as interrupts are typically not added to the test rings. The problem emerged after commit 5ef44b3cb43b removed the napiid assignment in _xdprxqinforeg() (Debian Tracker).

The vulnerability can lead to a NULL pointer dereference in the Linux kernel, which typically results in a system crash or denial of service condition when the ethtool loopback test is executed on affected systems (NVD CVE).

The issue has been fixed in Linux kernel version 6.16.8-1 and later releases. The fix involves using 0 as the last parameter in the affected function call, as there is no longer a need to pass a napiid to _xdprxqinfo_reg() (Debian Tracker).