CVE-2025-39911

In the Linux kernel, the following vulnerability has been resolved:

i40e: fix IRQ freeing in i40evsirequestirqmsix error path

If requestirq() in i40evsirequestirqmsix() fails in an iteration later than the first, the error path wants to free the IRQs requested so far. However, it uses the wrong devid argument for free_irq(), so it does not free the IRQs correctly and instead triggers the warning:

Trying to free already-free IRQ 173 WARNING: CPU: 25 PID: 1091 at kernel/irq/manage.c:1829 freeirq+0x192/0x2c0 Modules linked in: i40e(+) [...] CPU: 25 UID: 0 PID: 1091 Comm: NetworkManager Not tainted 6.17.0-rc1+ #1 PREEMPT(lazy) Hardware name: [...] RIP: 0010:freeirq+0x192/0x2c0 [...] Call Trace: <TASK> freeirq+0x32/0x70 i40evsirequestirqmsix.cold+0x63/0x8b [i40e] i40evsirequestirq+0x79/0x80 [i40e] i40evsiopen+0x21f/0x2f0 [i40e] i40eopen+0x63/0x130 [i40e] devopen+0xfc/0x210 _devchangeflags+0x1fc/0x240 netifchangeflags+0x27/0x70 dosetlink.isra.0+0x341/0xc70 rtnlnewlink+0x468/0x860 rtnetlinkrcvmsg+0x375/0x450 netlinkrcvskb+0x5c/0x110 netlinkunicast+0x288/0x3c0 netlinksendmsg+0x20d/0x430 _syssendmsg+0x3a2/0x3d0 _syssendmsg+0x99/0xe0 _syssendmsg+0x8a/0xf0 dosyscall64+0x82/0x2c0 entrySYSCALL64afterhwframe+0x76/0x7e [...] </TASK> ---[ end trace 0000000000000000 ]---

Use the same devid for freeirq() as for request_irq().

I tested this with inserting code to fail intentionally.