GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2025-39961 (GCVE-0-2025-39961)

Vulnerability from cvelistv5 – Published: 2025-10-09 12:13 – Updated: 2026-08-05 12:06
VLAI
Title
iommu/amd/pgtbl: Fix possible race while increase page table level
Summary
In the Linux kernel, the following vulnerability has been resolved: iommu/amd/pgtbl: Fix possible race while increase page table level The AMD IOMMU host page table implementation supports dynamic page table levels (up to 6 levels), starting with a 3-level configuration that expands based on IOVA address. The kernel maintains a root pointer and current page table level to enable proper page table walks in alloc_pte()/fetch_pte() operations. The IOMMU IOVA allocator initially starts with 32-bit address and onces its exhuasted it switches to 64-bit address (max address is determined based on IOMMU and device DMA capability). To support larger IOVA, AMD IOMMU driver increases page table level. But in unmap path (iommu_v1_unmap_pages()), fetch_pte() reads pgtable->[root/mode] without lock. So its possible that in exteme corner case, when increase_address_space() is updating pgtable->[root/mode], fetch_pte() reads wrong page table level (pgtable->mode). It does compare the value with level encoded in page table and returns NULL. This will result is iommu_unmap ops to fail and upper layer may retry/log WARN_ON. CPU 0 CPU 1 ------ ------ map pages unmap pages alloc_pte() -> increase_address_space() iommu_v1_unmap_pages() -> fetch_pte() pgtable->root = pte (new root value) READ pgtable->[mode/root] Reads new root, old mode Updates mode (pgtable->mode += 1) Since Page table level updates are infrequent and already synchronized with a spinlock, implement seqcount to enable lock-free read operations on the read path.
Severity
8.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 754265bcab78a9014f0f99cd35e0d610fcd7dfa7 , < 075abf0b1a958acfbea2435003d228e738e90346 (git)
Affected: 754265bcab78a9014f0f99cd35e0d610fcd7dfa7 , < cd92c8ab336c3a633d46e6f35ebcd3509ae7db3b (git)
Affected: 754265bcab78a9014f0f99cd35e0d610fcd7dfa7 , < 7d462bdecb7d9c32934dab44aaeb7ea7d73a27a2 (git)
Affected: 754265bcab78a9014f0f99cd35e0d610fcd7dfa7 , < 1e56310b40fd2e7e0b9493da9ff488af145bdd0c (git)
Affected: 6fb92f18555a7b8e085267d513612dc0ff9a5360 (git)
Affected: b15bf74405faa1a65025eb8a6eb337e140e5250a (git)
Affected: 0d50f7b1e8c80a8c20db5049e269468c059b0378 (git)
Affected: 785ca708a908b9c596ede852470ba28b8dc3e40b (git)
Affected: 4.9.194 , < 4.10 (semver)
Affected: 4.14.146 , < 4.15 (semver)
Affected: 4.19.75 , < 4.20 (semver)
Affected: 5.2.17 , < 5.3 (semver)
guessed Create a notification for this product.
Linux Linux Affected: 5.3
Unaffected: 0 , < 5.3 (semver)
Unaffected: 6.6.108 , ≤ 6.6.* (semver)
Unaffected: 6.12.49 , ≤ 6.12.* (semver)
Unaffected: 6.16.9 , ≤ 6.16.* (semver)
Unaffected: 6.17 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/iommu/amd/amd_iommu_types.h",
            "drivers/iommu/amd/io_pgtable.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "075abf0b1a958acfbea2435003d228e738e90346",
              "status": "affected",
              "version": "754265bcab78a9014f0f99cd35e0d610fcd7dfa7",
              "versionType": "git"
            },
            {
              "lessThan": "cd92c8ab336c3a633d46e6f35ebcd3509ae7db3b",
              "status": "affected",
              "version": "754265bcab78a9014f0f99cd35e0d610fcd7dfa7",
              "versionType": "git"
            },
            {
              "lessThan": "7d462bdecb7d9c32934dab44aaeb7ea7d73a27a2",
              "status": "affected",
              "version": "754265bcab78a9014f0f99cd35e0d610fcd7dfa7",
              "versionType": "git"
            },
            {
              "lessThan": "1e56310b40fd2e7e0b9493da9ff488af145bdd0c",
              "status": "affected",
              "version": "754265bcab78a9014f0f99cd35e0d610fcd7dfa7",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "6fb92f18555a7b8e085267d513612dc0ff9a5360",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "b15bf74405faa1a65025eb8a6eb337e140e5250a",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "0d50f7b1e8c80a8c20db5049e269468c059b0378",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "785ca708a908b9c596ede852470ba28b8dc3e40b",
              "versionType": "git"
            },
            {
              "lessThan": "4.10",
              "status": "affected",
              "version": "4.9.194",
              "versionType": "semver"
            },
            {
              "lessThan": "4.15",
              "status": "affected",
              "version": "4.14.146",
              "versionType": "semver"
            },
            {
              "lessThan": "4.20",
              "status": "affected",
              "version": "4.19.75",
              "versionType": "semver"
            },
            {
              "lessThan": "5.3",
              "status": "affected",
              "version": "5.2.17",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/iommu/amd/amd_iommu_types.h",
            "drivers/iommu/amd/io_pgtable.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.3"
            },
            {
              "lessThan": "5.3",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.108",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.49",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.16.*",
              "status": "unaffected",
              "version": "6.16.9",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.17",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.108",
                  "versionStartIncluding": "5.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.49",
                  "versionStartIncluding": "5.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.16.9",
                  "versionStartIncluding": "5.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.17",
                  "versionStartIncluding": "5.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "4.9.194",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "4.14.146",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "4.19.75",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "5.2.17",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\niommu/amd/pgtbl: Fix possible race while increase page table level\n\nThe AMD IOMMU host page table implementation supports dynamic page table levels\n(up to 6 levels), starting with a 3-level configuration that expands based on\nIOVA address. The kernel maintains a root pointer and current page table level\nto enable proper page table walks in alloc_pte()/fetch_pte() operations.\n\nThe IOMMU IOVA allocator initially starts with 32-bit address and onces its\nexhuasted it switches to 64-bit address (max address is determined based\non IOMMU and device DMA capability). To support larger IOVA, AMD IOMMU\ndriver increases page table level.\n\nBut in unmap path (iommu_v1_unmap_pages()), fetch_pte() reads\npgtable-\u003e[root/mode] without lock. So its possible that in exteme corner case,\nwhen increase_address_space() is updating pgtable-\u003e[root/mode], fetch_pte()\nreads wrong page table level (pgtable-\u003emode). It does compare the value with\nlevel encoded in page table and returns NULL. This will result is\niommu_unmap ops to fail and upper layer may retry/log WARN_ON.\n\nCPU 0                                         CPU 1\n------                                       ------\nmap pages                                    unmap pages\nalloc_pte() -\u003e increase_address_space()      iommu_v1_unmap_pages() -\u003e fetch_pte()\n  pgtable-\u003eroot = pte (new root value)\n                                             READ pgtable-\u003e[mode/root]\n\t\t\t\t\t       Reads new root, old mode\n  Updates mode (pgtable-\u003emode += 1)\n\nSince Page table level updates are infrequent and already synchronized with a\nspinlock, implement seqcount to enable lock-free read operations on the read path."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The race is reached through local DMA-mapping activity \u2014 either VFIO/iommufd map/unmap ioctls or ordinary syscall-driven I/O that exercises dma_map/dma_unmap on a device behind the AMD IOMMU. No network protocol handler processes remote data on this path.\nAC:L - The attacker controls both sides of the race: one thread issues a high-IOVA map that forces increase_address_space() while other threads issue concurrent unmaps on the same domain, and the attempt can be repeated indefinitely because each newly created protection_domain restarts at PAGE_MODE_3_LEVEL. No condition depends on state outside the attacker\u0027s influence, and CONFIG_AMD_IOMMU with v1 host page tables is the default on all AMD x86_64 systems.\nPR:L - An unprivileged local user can drive the concurrent map/unmap traffic that exhausts the 32-bit IOVA space and triggers the page-table level increase; in device-assignment deployments the VFIO/iommufd ioctl path is exercised by an unprivileged QEMU process. No root or capability in the init namespace is required.\nUI:N - The race is triggered entirely by the attacker\u0027s own concurrent DMA map/unmap operations. No victim action is needed.\nS:C - A silently-failed iommu_v1_unmap_pages() leaves a live IOMMU translation after __iommu_dma_unmap() frees the IOVA and the driver recycles the buffer, so a DMA-capable device \u2014 including a guest-controlled assigned device \u2014 retains read/write access to host physical memory it must no longer reach. This is an IOMMU/DMA containment bypass that crosses out of the kernel\u0027s own security authority.\nC:H - The stale mapping lets the device read physical pages that have been returned to the allocator and refilled with arbitrary kernel or other-tenant data, giving an unbounded read primitive over reused memory; the torn read in alloc_pte() can additionally alias a mapping onto another buffer in the domain.\nI:H - The same stale or mis-installed translation is writable, so the device can DMA arbitrary attacker-chosen data into freed-and-reused kernel memory, yielding a write primitive suitable for control-flow hijacking. The corruption is invisible to the kernel because the unmap was reported as complete.\nA:H - The failed unmap immediately produces WARN_ON splats in __iommu_dma_unmap()/iommu_unmap_nofail() (a panic with panic_on_warn), and the resulting DMA into recycled memory or the mis-built page-table subtree causes IO page faults, page-table page leaks, and kernel crashes."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:06:29.974Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/075abf0b1a958acfbea2435003d228e738e90346"
        },
        {
          "url": "https://git.kernel.org/stable/c/cd92c8ab336c3a633d46e6f35ebcd3509ae7db3b"
        },
        {
          "url": "https://git.kernel.org/stable/c/7d462bdecb7d9c32934dab44aaeb7ea7d73a27a2"
        },
        {
          "url": "https://git.kernel.org/stable/c/1e56310b40fd2e7e0b9493da9ff488af145bdd0c"
        }
      ],
      "title": "iommu/amd/pgtbl: Fix possible race while increase page table level",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-39961",
    "datePublished": "2025-10-09T12:13:22.029Z",
    "dateReserved": "2025-04-16T07:20:57.149Z",
    "dateUpdated": "2026-08-05T12:06:29.974Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-39961",
      "date": "2026-09-17",
      "epss": "0.00115",
      "percentile": "0.01754"
    },
    "microsoft_vex": {
      "current_release_date": "2025-10-11T01:01:50.000Z",
      "cve": "CVE-2025-39961",
      "id": "msrc_CVE-2025-39961",
      "initial_release_date": "2025-10-02T00:00:00.000Z",
      "product_status:fixed": "1",
      "product_status:known_affected": "2",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "iommu/amd/pgtbl: Fix possible race while increase page table level",
      "url": "https://msrc.microsoft.com/csaf/vex/2025/msrc_cve-2025-39961.json",
      "version": "1"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-39961\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-10-09T13:15:32.250\",\"lastModified\":\"2026-07-30T06:24:01.087\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\niommu/amd/pgtbl: Fix possible race while increase page table level\\n\\nThe AMD IOMMU host page table implementation supports dynamic page table levels\\n(up to 6 levels), starting with a 3-level configuration that expands based on\\nIOVA address. The kernel maintains a root pointer and current page table level\\nto enable proper page table walks in alloc_pte()/fetch_pte() operations.\\n\\nThe IOMMU IOVA allocator initially starts with 32-bit address and onces its\\nexhuasted it switches to 64-bit address (max address is determined based\\non IOMMU and device DMA capability). To support larger IOVA, AMD IOMMU\\ndriver increases page table level.\\n\\nBut in unmap path (iommu_v1_unmap_pages()), fetch_pte() reads\\npgtable-\u003e[root/mode] without lock. So its possible that in exteme corner case,\\nwhen increase_address_space() is updating pgtable-\u003e[root/mode], fetch_pte()\\nreads wrong page table level (pgtable-\u003emode). It does compare the value with\\nlevel encoded in page table and returns NULL. This will result is\\niommu_unmap ops to fail and upper layer may retry/log WARN_ON.\\n\\nCPU 0                                         CPU 1\\n------                                       ------\\nmap pages                                    unmap pages\\nalloc_pte() -\u003e increase_address_space()      iommu_v1_unmap_pages() -\u003e fetch_pte()\\n  pgtable-\u003eroot = pte (new root value)\\n                                             READ pgtable-\u003e[mode/root]\\n\\t\\t\\t\\t\\t       Reads new root, old mode\\n  Updates mode (pgtable-\u003emode += 1)\\n\\nSince Page table level updates are infrequent and already synchronized with a\\nspinlock, implement seqcount to enable lock-free read operations on the read path.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/iommu/amd/amd_iommu_types.h\",\"drivers/iommu/amd/io_pgtable.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"754265bcab78a9014f0f99cd35e0d610fcd7dfa7\",\"lessThan\":\"075abf0b1a958acfbea2435003d228e738e90346\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"754265bcab78a9014f0f99cd35e0d610fcd7dfa7\",\"lessThan\":\"cd92c8ab336c3a633d46e6f35ebcd3509ae7db3b\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"754265bcab78a9014f0f99cd35e0d610fcd7dfa7\",\"lessThan\":\"7d462bdecb7d9c32934dab44aaeb7ea7d73a27a2\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"754265bcab78a9014f0f99cd35e0d610fcd7dfa7\",\"lessThan\":\"1e56310b40fd2e7e0b9493da9ff488af145bdd0c\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"6fb92f18555a7b8e085267d513612dc0ff9a5360\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"b15bf74405faa1a65025eb8a6eb337e140e5250a\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"0d50f7b1e8c80a8c20db5049e269468c059b0378\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"785ca708a908b9c596ede852470ba28b8dc3e40b\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"4.9.194\",\"lessThan\":\"4.10\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"4.14.146\",\"lessThan\":\"4.15\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"4.19.75\",\"lessThan\":\"4.20\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"5.2.17\",\"lessThan\":\"5.3\",\"versionType\":\"semver\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/iommu/amd/amd_iommu_types.h\",\"drivers/iommu/amd/io_pgtable.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"5.3\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"5.3\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.108\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.49\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.16.9\",\"lessThanOrEqual\":\"6.16.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.17\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H\",\"baseScore\":8.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"CHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":2.0,\"impactScore\":6.0},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":4.7,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"HIGH\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.0,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-362\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.9.194\",\"versionEndExcluding\":\"4.10\",\"matchCriteriaId\":\"2572FA5E-845E-4DF3-9D9C-8918ECC777C8\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.14.146\",\"versionEndExcluding\":\"4.15\",\"matchCriteriaId\":\"F1F3489C-0F08-4C44-9AFD-D45E286F51D3\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.19.75\",\"versionEndExcluding\":\"4.20\",\"matchCriteriaId\":\"5EC25515-A753-47F9-823B-4483BE60F328\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.2.17\",\"versionEndExcluding\":\"5.3\",\"matchCriteriaId\":\"C42AB381-30AB-4C50-8C95-A4BFAF431AFB\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.3.1\",\"versionEndExcluding\":\"6.6.108\",\"matchCriteriaId\":\"983311BA-7332-42E8-9C1F-71C82FC23C03\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.12.49\",\"matchCriteriaId\":\"CAA033E9-A2C5-4976-A83E-9804D8FB827F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.13\",\"versionEndExcluding\":\"6.16.9\",\"matchCriteriaId\":\"638DD910-1189-4F5E-98BF-2D436B695112\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:5.3:-:*:*:*:*:*:*\",\"matchCriteriaId\":\"D036D76E-AC69-4382-B4C1-8EDA1ABB2941\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:5.3:rc8:*:*:*:*:*:*\",\"matchCriteriaId\":\"999345BA-F820-40B9-A711-32CA9265C289\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.17:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"327D22EF-390B-454C-BD31-2ED23C998A1C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.17:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"C730CD9A-D969-4A8E-9522-162AAF7C0EE9\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.17:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"39982C4B-716E-4B2F-8196-FA301F47807D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.17:rc4:*:*:*:*:*:*\",\"matchCriteriaId\":\"340BEEA9-D70D-4290-B502-FBB1032353B1\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.17:rc5:*:*:*:*:*:*\",\"matchCriteriaId\":\"47E4C5C0-079F-4838-971B-8C503D48FCC2\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.17:rc6:*:*:*:*:*:*\",\"matchCriteriaId\":\"5A4516A6-C12E-42A4-8C0E-68AEF3264504\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/075abf0b1a958acfbea2435003d228e738e90346\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/1e56310b40fd2e7e0b9493da9ff488af145bdd0c\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/7d462bdecb7d9c32934dab44aaeb7ea7d73a27a2\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/cd92c8ab336c3a633d46e6f35ebcd3509ae7db3b\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-21T02:29:29+00:00",
      "cve": "CVE-2025-39961",
      "id": "CVE-2025-39961",
      "initial_release_date": "2025-10-09T00:00:00+00:00",
      "product_status:known_affected": "232",
      "product_status:known_not_affected": "42",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: iommu/amd/pgtbl: Fix possible race while increase page table level",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-39961.json",
      "version": "3"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.