Vulnerability-Lookup

SUSE-SU-2025:4189-1

Vulnerability from csaf_suse - Published: 2025-11-24 09:18 - Updated: 2025-11-24 09:18

Summary

Security update for the Linux Kernel

Severity

Important

Notes

Title of the patch: Security update for the Linux Kernel

Description of the patch: The SUSE Linux Enterprise 12 SP5 kernel was updated to fix various security issues The following security issues were fixed: - CVE-2021-4460: drm/amdkfd: Fix UBSAN shift-out-of-bounds warning (bsc#1250764). - CVE-2022-48631: ext4: fix bug in extents parsing when eh_entries == 0 and eh_depth > 0 (bsc#1223475). - CVE-2022-50236: iommu/mediatek: Fix crash on isr after kexec() (bsc#1249702). - CVE-2022-50249: memory: of: Fix refcount leak bug in of_get_ddr_timings() (bsc#1249747). - CVE-2022-50280: pnode: terminate at peers of source (bsc#1249806). - CVE-2022-50293: btrfs: do not BUG_ON() on ENOMEM when dropping extent items for a range (bsc#1249752). - CVE-2022-50327: ACPI: processor: idle: Check acpi_fetch_acpi_dev() return value (bsc#1249859). - CVE-2022-50350: scsi: target: iscsi: Fix a race condition between login_work and the login thread (bsc#1250261). - CVE-2022-50356: net: sched: sfb: fix null pointer access issue when sfb_init() fails (bsc#1250040). - CVE-2022-50367: fs: fix UAF/GPF bug in nilfs_mdt_destroy (bsc#1250277). - CVE-2022-50394: i2c: ismt: Fix an out-of-bounds bug in ismt_access() (bsc#1250107). - CVE-2022-50395: integrity: Fix memory leakage in keyring allocation error path (bsc#1250211). - CVE-2022-50423: ACPICA: Fix use-after-free in acpi_ut_copy_ipackage_to_ipackage() (bsc#1250784). - CVE-2022-50443: drm/rockchip: lvds: fix PM usage counter unbalance in poweron (bsc#1250768). - CVE-2022-50459: scsi: iscsi: iscsi_tcp: Fix null-ptr-deref while calling getpeername() (bsc#1250850). - CVE-2022-50481: cxl: fix possible null-ptr-deref in cxl_guest_init_afu|adapter() (bsc#1251051). - CVE-2022-50485: ext4: add EXT4_IGET_BAD flag to prevent unexpected bad inode (bsc#1251197). - CVE-2022-50505: iommu/amd: Fix pci device refcount leak in ppr_notifier() (bsc#1251086). - CVE-2022-50516: fs: dlm: fix invalid derefence of sb_lvbptr (bsc#1251741). - CVE-2022-50542: media: si470x: Fix use-after-free in si470x_int_in_callback() (bsc#1251330). - CVE-2022-50571: btrfs: call __btrfs_remove_free_space_cache_locked on cache load failure (bsc#1252487). - CVE-2023-53183: btrfs: exit gracefully if reloc roots don't match (bsc#1249863). - CVE-2023-53185: wifi: ath9k: don't allow to overwrite ENDPOINT0 attributes (bsc#1249820). - CVE-2023-53188: net: openvswitch: fix race on port output (bsc#1249854). - CVE-2023-53191: irqchip/alpine-msi: Fix refcount leak in alpine_msix_init_domains (bsc#1249721). - CVE-2023-53204: af_unix: Fix data-races around user->unix_inflight (bsc#1249682). - CVE-2023-53271: ubi: Fix unreferenced object reported by kmemleak in ubi_resize_volume() (bsc#1249916). - CVE-2023-53282: scsi: lpfc: Fix use-after-free KFENCE violation during sysfs firmware write (bsc#1250311). - CVE-2023-53289: media: bdisp: Add missing check for create_workqueue (bsc#1249941). - CVE-2023-53292: blk-mq: protect q->elevator by ->sysfs_lock in blk_mq_elv_switch_none (bsc#1250163). - CVE-2023-53338: lwt: Fix return values of BPF xmit ops (bsc#1250074). - CVE-2023-53339: btrfs: fix BUG_ON condition in btrfs_cancel_balance (bsc#1250329). - CVE-2023-53373: crypto: seqiv - Handle EBUSY correctly (bsc#1250137). - CVE-2023-53433: net: add vlan_get_protocol_and_depth() helper (bsc#1250164). - CVE-2023-53476: iw_cxgb4: Fix potential NULL dereference in c4iw_fill_res_cm_id_entry() (bsc#1250839). - CVE-2023-53477: ipv6: Add lwtunnel encap size of all siblings in nexthop calculation (bsc#1250840). - CVE-2023-53484: lib: cpu_rmap: Avoid use after free on rmap->obj array entries (bsc#1250895). - CVE-2023-53517: tipc: do not update mtu if msg_max is too small in mtu negotiation (bsc#1250919). - CVE-2023-53519: media: v4l2-mem2mem: add lock to protect parameter num_rdy (bsc#1250964). - CVE-2023-53540: wifi: cfg80211: reject auth/assoc to AP with our address (bsc#1251053). - CVE-2023-53548: net: usbnet: Fix WARNING in usbnet_start_xmit/usb_submit_urb (bsc#1251066). - CVE-2023-53556: iavf: Fix use-after-free in free_netdev (bsc#1251059). - CVE-2023-53559: ip_vti: fix potential slab-use-after-free in decode_session6 (bsc#1251052). - CVE-2023-53582: wifi: brcmfmac: ensure CLM version is null-terminated to prevent stack-out-of-bounds (bsc#1251061). - CVE-2023-53589: wifi: iwlwifi: mvm: don't trust firmware n_channels (bsc#1251129). - CVE-2023-53593: cifs: Release folio lock on fscache read hit (bsc#1251132). - CVE-2023-53594: driver core: fix resource leak in device_add() (bsc#1251166). - CVE-2023-53596: drivers: base: Free devm resources when unregistering a device (bsc#1251161). - CVE-2023-53619: netfilter: conntrack: Avoid nf_ct_helper_hash uses after free (bsc#1251743). - CVE-2023-53620: md: fix soft lockup in status_resync. - CVE-2023-53624: net/sched: sch_fq: fix integer overflow of 'credit' (bsc#1251333). - CVE-2023-53635: netfilter: conntrack: fix wrong ct->timeout value (bsc#1251524). - CVE-2023-53648: ALSA: ac97: Fix possible NULL dereference in snd_ac97_mixer (bsc#1251750). - CVE-2023-53687: tty: serial: samsung_tty: Fix a memory leak in s3c24xx_serial_getclk() when iterating clk (bsc#1251772). - CVE-2023-53695: udf: Detect system inodes linked into directory hierarchy (bsc#1252539). - CVE-2023-53705: ipv6: Fix out-of-bounds access in ipv6_find_tlv() (bsc#1252554). - CVE-2023-53707: drm/amdgpu: Fix integer overflow in amdgpu_cs_pass1 (bsc#1252632). - CVE-2023-53715: wifi: brcmfmac: cfg80211: Pass the PMK in binary instead of hex (bsc#1252545). - CVE-2023-53717: wifi: ath9k: Fix potential stack-out-of-bounds write in ath9k_wmi_rsp_callback() (bsc#1252560). - CVE-2023-53733: net: sched: cls_u32: Undo tcf_bind_filter if u32_replace_hw_knode (bsc#1252685). - CVE-2025-38539: trace/fgraph: Fix the warning caused by missing unregister notifier (bsc#1248211). - CVE-2025-38680: media: uvcvideo: Fix 1-byte out-of-bounds read in uvc_parse_format() (bsc#1249203). - CVE-2025-38691: pNFS: Fix uninited ptr deref in block/scsi layout (bsc#1249215). - CVE-2025-38695: scsi: lpfc: Check for hdwq null ptr when cleaning up lpfc_vport structure (bsc#1249285). - CVE-2025-38699: scsi: bfa: Double-free fix (bsc#1249224). - CVE-2025-38700: scsi: libiscsi: Initialize iscsi_conn->dd_data only if memory is allocated (bsc#1249182). - CVE-2025-38714: hfsplus: fix slab-out-of-bounds in hfsplus_bnode_read() (bsc#1249260). - CVE-2025-38718: sctp: linearize cloned gso packets in sctp_rcv (bsc#1249161). - CVE-2025-38724: nfsd: handle get_client_locked() failure in nfsd4_setclientid_confirm() (bsc#1249169). - CVE-2025-39676: scsi: qla4xxx: Prevent a potential error pointer dereference (bsc#1249302). - CVE-2025-39702: ipv6: sr: Fix MAC comparison to be constant-time (bsc#1249317). - CVE-2025-39724: serial: 8250: fix panic due to PSLVERR (bsc#1249265). - CVE-2025-39756: fs: Prevent file descriptor table allocations exceeding INT_MAX (bsc#1249512). - CVE-2025-39772: drm/hisilicon/hibmc: fix the hibmc loaded failed bug (bsc#1249506). - CVE-2025-39812: sctp: initialize more fields in sctp_v6_from_sk() (bsc#1250202). - CVE-2025-39813: ftrace: Fix potential warning in trace_printk_seq during ftrace_dump (bsc#1250032). - CVE-2025-39841: scsi: lpfc: Fix buffer free/clear order in deferred receive path (bsc#1250274). - CVE-2025-39866: fs: writeback: fix use-after-free in __mark_inode_dirty() (bsc#1250455). - CVE-2025-39876: net: fec: Fix possible NPD in fec_enet_phy_reset_after_clk_enable() (bsc#1250400). - CVE-2025-39911: i40e: fix IRQ freeing in i40e_vsi_request_irq_msix error path (bsc#1250704). - CVE-2025-39923: dmaengine: qcom: bam_dma: Fix DT error handling for num-channels/ees (bsc#1250741). - CVE-2025-39929: smb: client: fix smbdirect_recv_io leak in smbd_negotiate() error path (bsc#1251036). - CVE-2025-39931: crypto: af_alg - Set merge to zero early in af_alg_sendmsg (bsc#1251100). - CVE-2025-39945: cnic: Fix use-after-free bugs in cnic_delete_task (bsc#1251230). - CVE-2025-39949: qed: Don't collect too many protection override GRC elements (bsc#1251177). - CVE-2025-39955: tcp: Clear tcp_sk(sk)->fastopen_rsk in tcp_disconnect() (bsc#1251804). - CVE-2025-39968: i40e: add max boundary check for VF filters (bsc#1252047). - CVE-2025-39970: i40e: Fix filter input checks to prevent config with invalid values (bsc#1252051). - CVE-2025-39971: i40e: Add bounds check for ch[] array (bsc#1252052). - CVE-2025-39972: i40e: fix idx validation in i40e_validate_queue_map (bsc#1252039). - CVE-2025-39973: i40e: add validation for ring_len param (bsc#1252035). - CVE-2025-39997: ALSA: usb-audio: fix race condition to UAF in snd_usbmidi_free (bsc#1252056). - CVE-2025-40018: ipvs: Defer ip_vs_ftp unregister during netns cleanup (bsc#1252688). - CVE-2025-40044: fs: udf: fix OOB read in lengthAllocDescs handling (bsc#1252785). - CVE-2025-40049: Squashfs: fix uninit-value in squashfs_get_parent (bsc#1252822). - CVE-2025-40078: bpf: Explicitly check accesses to bpf_sock_addr (bsc#1252789). - CVE-2025-40082: hfsplus: fix slab-out-of-bounds read in hfsplus_uni2asc() (bsc#1252775). - CVE-2025-40088: hfsplus: fix slab-out-of-bounds read in hfsplus_strcasecmp() (bsc#1252904). The following non security issues were fixed: - NFSv4.1: fix backchannel max_resp_sz verification check (bsc#1247518). - net: hv_netvsc: fix loss of early receive events from host during channel open (bsc#1252265). - openvswitch: fix lockup on tx to unregistering netdev with carrier (bsc#1249854)

Patchnames: SUSE-2025-4189,SUSE-SLE-Live-Patching-12-SP5-2025-4189,SUSE-SLE-SERVER-12-SP5-LTSS-2025-4189,SUSE-SLE-SERVER-12-SP5-LTSS-EXTENDED-SECURITY-2025-4189

CVE-2021-4460

5.8 (Medium)


                
                  CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:H

Affected products

Recommended 56 products

Product	Version	Remediation
Unresolved product id: SUSE Linux Enterprise Live Patching 12 SP5:kernel-default-kgraft-4.12.14-122.280.1.ppc64le	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Live Patching 12 SP5:kernel-default-kgraft-4.12.14-122.280.1.s390x	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Live Patching 12 SP5:kernel-default-kgraft-4.12.14-122.280.1.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Live Patching 12 SP5:kernel-default-kgraft-devel-4.12.14-122.280.1.ppc64le	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Live Patching 12 SP5:kernel-default-kgraft-devel-4.12.14-122.280.1.s390x	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Live Patching 12 SP5:kernel-default-kgraft-devel-4.12.14-122.280.1.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Live Patching 12 SP5:kgraft-patch-4_12_14-122_280-default-1-8.5.1.ppc64le	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Live Patching 12 SP5:kgraft-patch-4_12_14-122_280-default-1-8.5.1.s390x	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Live Patching 12 SP5:kgraft-patch-4_12_14-122_280-default-1-8.5.1.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 12 SP5-LTSS:cluster-md-kmp-default-4.12.14-122.280.1.aarch64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 12 SP5-LTSS:cluster-md-kmp-default-4.12.14-122.280.1.ppc64le	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 12 SP5-LTSS:cluster-md-kmp-default-4.12.14-122.280.1.s390x	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 12 SP5-LTSS:cluster-md-kmp-default-4.12.14-122.280.1.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 12 SP5-LTSS:dlm-kmp-default-4.12.14-122.280.1.aarch64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 12 SP5-LTSS:dlm-kmp-default-4.12.14-122.280.1.ppc64le	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 12 SP5-LTSS:dlm-kmp-default-4.12.14-122.280.1.s390x	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 12 SP5-LTSS:dlm-kmp-default-4.12.14-122.280.1.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 12 SP5-LTSS:gfs2-kmp-default-4.12.14-122.280.1.aarch64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 12 SP5-LTSS:gfs2-kmp-default-4.12.14-122.280.1.ppc64le	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 12 SP5-LTSS:gfs2-kmp-default-4.12.14-122.280.1.s390x	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 12 SP5-LTSS:gfs2-kmp-default-4.12.14-122.280.1.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 12 SP5-LTSS:kernel-default-4.12.14-122.280.1.aarch64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 12 SP5-LTSS:kernel-default-4.12.14-122.280.1.ppc64le	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 12 SP5-LTSS:kernel-default-4.12.14-122.280.1.s390x	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 12 SP5-LTSS:kernel-default-4.12.14-122.280.1.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 12 SP5-LTSS:kernel-default-base-4.12.14-122.280.1.aarch64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 12 SP5-LTSS:kernel-default-base-4.12.14-122.280.1.ppc64le	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 12 SP5-LTSS:kernel-default-base-4.12.14-122.280.1.s390x	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 12 SP5-LTSS:kernel-default-base-4.12.14-122.280.1.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 12 SP5-LTSS:kernel-default-devel-4.12.14-122.280.1.aarch64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 12 SP5-LTSS:kernel-default-devel-4.12.14-122.280.1.ppc64le	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 12 SP5-LTSS:kernel-default-devel-4.12.14-122.280.1.s390x	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 12 SP5-LTSS:kernel-default-devel-4.12.14-122.280.1.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 12 SP5-LTSS:kernel-default-man-4.12.14-122.280.1.s390x	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 12 SP5-LTSS:kernel-devel-4.12.14-122.280.1.noarch	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 12 SP5-LTSS:kernel-macros-4.12.14-122.280.1.noarch	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 12 SP5-LTSS:kernel-source-4.12.14-122.280.1.noarch	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 12 SP5-LTSS:kernel-syms-4.12.14-122.280.1.aarch64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 12 SP5-LTSS:kernel-syms-4.12.14-122.280.1.ppc64le	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 12 SP5-LTSS:kernel-syms-4.12.14-122.280.1.s390x	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 12 SP5-LTSS:kernel-syms-4.12.14-122.280.1.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 12 SP5-LTSS:ocfs2-kmp-default-4.12.14-122.280.1.aarch64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 12 SP5-LTSS:ocfs2-kmp-default-4.12.14-122.280.1.ppc64le	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 12 SP5-LTSS:ocfs2-kmp-default-4.12.14-122.280.1.s390x	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 12 SP5-LTSS:ocfs2-kmp-default-4.12.14-122.280.1.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server LTSS Extended Security 12 SP5:cluster-md-kmp-default-4.12.14-122.280.1.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server LTSS Extended Security 12 SP5:dlm-kmp-default-4.12.14-122.280.1.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server LTSS Extended Security 12 SP5:gfs2-kmp-default-4.12.14-122.280.1.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server LTSS Extended Security 12 SP5:kernel-default-4.12.14-122.280.1.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server LTSS Extended Security 12 SP5:kernel-default-base-4.12.14-122.280.1.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server LTSS Extended Security 12 SP5:kernel-default-devel-4.12.14-122.280.1.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server LTSS Extended Security 12 SP5:kernel-devel-4.12.14-122.280.1.noarch	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server LTSS Extended Security 12 SP5:kernel-macros-4.12.14-122.280.1.noarch	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server LTSS Extended Security 12 SP5:kernel-source-4.12.14-122.280.1.noarch	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server LTSS Extended Security 12 SP5:kernel-syms-4.12.14-122.280.1.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server LTSS Extended Security 12 SP5:ocfs2-kmp-default-4.12.14-122.280.1.x86_64	—	Vendor Fix

Threats

Impact moderate

CVE-2022-43945

8.8 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected products

Recommended 56 products, the same list as for CVE-2021-4460

Threats

Impact important

CVE-2022-48631

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected products

Recommended 56 products, the same list as for CVE-2021-4460

Threats

Impact moderate

CVE-2022-50236

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected products

Recommended 56 products, the same list as for CVE-2021-4460

Threats

Impact moderate

CVE-2022-50249

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected products

Recommended 56 products, the same list as for CVE-2021-4460

Threats

Impact moderate

CVE-2022-50280

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected products

Recommended 56 products, the same list as for CVE-2021-4460

Threats

Impact moderate

CVE-2022-50293

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected products

Recommended 56 products, the same list as for CVE-2021-4460

Threats

Impact moderate

CVE-2022-50327

7 (High)


                
                  CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected products

Recommended 56 products, the same list as for CVE-2021-4460

Threats

Impact important

CVE-2022-50350

4.7 (Medium)


                
                  CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected products

Recommended 56 products, the same list as for CVE-2021-4460

Threats

Impact moderate

CVE-2022-50356

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected products

Recommended 56 products, the same list as for CVE-2021-4460

Threats

Impact moderate

CVE-2022-50367

7 (High)


                
                  CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected products

Recommended 56 products, the same list as for CVE-2021-4460

Threats

Impact important

CVE-2022-50394

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected products

Recommended 56 products, the same list as for CVE-2021-4460

Threats

Impact moderate

CVE-2022-50395

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected products

Recommended 56 products, the same list as for CVE-2021-4460

Threats

Impact moderate

CVE-2022-50423

7.8 (High)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected products

Recommended 56 products, the same list as for CVE-2021-4460

Threats

Impact important

CVE-2022-50443

4.4 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

Affected products

Recommended 56 products, the same list as for CVE-2021-4460

Threats

Impact moderate

CVE-2022-50459

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected products

Recommended 56 products, the same list as for CVE-2021-4460

Threats

Impact moderate

CVE-2022-50470

5.3 (Medium)


                
                  CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H

Affected products

Recommended 56 products, the same list as for CVE-2021-4460

Threats

Impact moderate

CVE-2022-50481

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected products

Recommended 56 products, the same list as for CVE-2021-4460

Threats

Impact moderate

CVE-2022-50485

6.6 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H

Affected products

Recommended 56 products, the same list as for CVE-2021-4460

Threats

Impact moderate

CVE-2022-50487

7.1 (High)


                
                  CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H

Affected products

Recommended 56 products, the same list as for CVE-2021-4460

Threats

Impact important

CVE-2022-50493

4.4 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

Affected products

Recommended 56 products, the same list as for CVE-2021-4460

Threats

Impact moderate

CVE-2022-50496

6.4 (Medium)


                
                  CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H

Affected products

Recommended 56 products, the same list as for CVE-2021-4460

Threats

Impact moderate

CVE-2022-50501

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected products

Recommended 56 products, the same list as for CVE-2021-4460

Threats

Impact moderate

CVE-2022-50504

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected products

Recommended 56 products, the same list as for CVE-2021-4460

Threats

Impact moderate

CVE-2022-50505

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected products

Recommended 56 products, the same list as for CVE-2021-4460

Threats

Impact moderate

CVE-2022-50509

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected products

Recommended 56 products, the same list as for CVE-2021-4460

Threats

Impact moderate

CVE-2022-50516

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected products

Recommended 56 products, the same list as for CVE-2021-4460

Threats

Impact moderate

CVE-2022-50532

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected products

Recommended 56 products, the same list as for CVE-2021-4460

Threats

Impact moderate

CVE-2022-50534

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected products

Recommended 56 products, the same list as for CVE-2021-4460

Threats

Impact moderate

CVE-2022-50536

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected products

Recommended 56 products, the same list as for CVE-2021-4460

Threats

Impact moderate

CVE-2022-50537

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected products

Recommended 56 products, the same list as for CVE-2021-4460

Threats

Impact moderate

CVE-2022-50542

6.3 (Medium)


                
                  CVSS:3.1/AV:P/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected products

Recommended 56 products, the same list as for CVE-2021-4460

Threats

Impact moderate

CVE-2022-50544

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected products

Recommended 56 products, the same list as for CVE-2021-4460

Threats

Impact moderate

CVE-2022-50549

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected products

Recommended 56 products, the same list as for CVE-2021-4460

Threats

Impact moderate

CVE-2022-50563

5.8 (Medium)


                
                  CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:H

Affected products

Recommended 56 products, the same list as for CVE-2021-4460

Threats

Impact moderate

CVE-2022-50564

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected products

Recommended 56 products, the same list as for CVE-2021-4460

Threats

Impact moderate

CVE-2022-50571

4.7 (Medium)


                
                  CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected products

Recommended 56 products, the same list as for CVE-2021-4460

Threats

Impact moderate

CVE-2022-50581

6.6 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H

Affected products

Recommended 56 products, the same list as for CVE-2021-4460

Threats

Impact moderate

CVE-2023-53183

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected products

Recommended 56 products, the same list as for CVE-2021-4460

Threats

Impact moderate

CVE-2023-53185

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected products

Recommended 56 products, the same list as for CVE-2021-4460

Threats

Impact moderate

CVE-2023-53188

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected products

Recommended 56 products, the same list as for CVE-2021-4460

Threats

Impact moderate

CVE-2023-53191

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected products

Recommended 56 products, the same list as for CVE-2021-4460

Threats

Impact moderate

CVE-2023-53204

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected products

Recommended 56 products, the same list as for CVE-2021-4460

Threats

Impact moderate

CVE-2023-53271

3.3 (Low)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

Affected products

Recommended 56 products, the same list as for CVE-2021-4460

Threats

Impact low

CVE-2023-53282

6.4 (Medium)


                
                  CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H

Affected products

Recommended 56 products, the same list as for CVE-2021-4460

Threats

Impact moderate

CVE-2023-53289

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected products

Recommended 56 products, the same list as for CVE-2021-4460

Threats

Impact moderate

CVE-2023-53292

4.7 (Medium)


                
                  CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected products

Recommended 56 products, the same list as for CVE-2021-4460

Threats

Impact moderate

CVE-2023-53338

6.7 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Affected products

Recommended 56 products, the same list as for CVE-2021-4460

Threats

Impact moderate

CVE-2023-53339

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected products

Recommended 56 products, the same list as for CVE-2021-4460

Threats

Impact moderate

CVE-2023-53373

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected products

Recommended 56 products, the same list as for CVE-2021-4460

Threats

Impact moderate

CVE-2023-53433

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected products

Recommended 56 products, the same list as for CVE-2021-4460

Threats

Impact moderate

CVE-2023-53476

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected products

Recommended 56 products, the same list as for CVE-2021-4460

Threats

Impact moderate

CVE-2023-53477

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected products

Recommended 56 products, the same list as for CVE-2021-4460

Threats

Impact moderate

CVE-2023-53484

6.2 (Medium)


                
                  CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H

Affected products

Recommended 56 products, the same list as for CVE-2021-4460

Threats

Impact moderate

CVE-2023-53517

6.5 (Medium)


                
                  CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected products

Recommended 56 products, the same list as for CVE-2021-4460

Threats

Impact moderate

CVE-2023-53519

4.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L

Affected products

Recommended 56 products, the same list as for CVE-2021-4460

Threats

Impact moderate

CVE-2023-53533

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected products

Recommended 56 products, the same list as for CVE-2021-4460

Threats

Impact moderate

CVE-2023-53540

6.5 (Medium)


                
                  CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected products

Recommended 56 products, the same list as for CVE-2021-4460

Threats

Impact moderate

CVE-2023-53548

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected products

Recommended 56 products, the same list as for CVE-2021-4460

Threats

Impact moderate

CVE-2023-53556

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected products

Recommended 56 products, the same list as for CVE-2021-4460

Threats

Impact moderate

CVE-2023-53559

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected products

Recommended 56 products, the same list as for CVE-2021-4460

Threats

Impact moderate

CVE-2023-53564

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected products

Recommended 56 products, the same list as for CVE-2021-4460

Threats

Impact moderate

CVE-2023-53568

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected products

Recommended 56 products, the same list as for CVE-2021-4460

Threats

Impact moderate

CVE-2023-53582

6.1 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H

Affected products

Recommended 56 products, the same list as for CVE-2021-4460

Threats

Impact moderate

CVE-2023-53587

6.4 (Medium)


                
                  CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H

Affected products

Recommended 56 products, the same list as for CVE-2021-4460

Threats

Impact moderate

CVE-2023-53589

5.1 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:L

Affected products

Recommended 56 products, the same list as for CVE-2021-4460

Threats

Impact moderate

CVE-2023-53593

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected products

Recommended 56 products, the same list as for CVE-2021-4460

Threats

Impact moderate

CVE-2023-53594

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected products

Recommended 56 products, the same list as for CVE-2021-4460

Threats

Impact moderate

CVE-2023-53596

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected products

Recommended 56 products, the same list as for CVE-2021-4460

Threats

Impact moderate

CVE-2023-53603

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected products

Recommended 56 products, the same list as for CVE-2021-4460

Threats

Impact moderate

CVE-2023-53604

4.7 (Medium)


                
                  CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected products

Recommended 56 products, the same list as for CVE-2021-4460

Threats

Impact moderate

CVE-2023-53611

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected products

Recommended 56 products, the same list as for CVE-2021-4460

Threats

Impact moderate

CVE-2023-53615

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected products

Recommended 56 products, the same list as for CVE-2021-4460

Threats

Impact moderate

CVE-2023-53619

6.7 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Affected products

Recommended 56 products, the same list as for CVE-2021-4460

Threats

Impact moderate

CVE-2023-53620

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected products

Recommended 56 products, the same list as for CVE-2021-4460

Threats

Impact moderate

CVE-2023-53622

5.3 (Medium)


                
                  CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H

Affected products

Recommended 56 products, the same list as for CVE-2021-4460

Threats

Impact moderate

CVE-2023-53624

6.1 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H

Affected products

Recommended 56 products, the same list as for CVE-2021-4460

Threats

Impact moderate

CVE-2023-53635

6.1 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H

Affected products

Recommended 56 products, the same list as for CVE-2021-4460

Threats

Impact moderate

CVE-2023-53644

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected products

Recommended 56 products, the same list as for CVE-2021-4460

Threats

Impact moderate

CVE-2023-53647

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected products

Recommended 56 products, the same list as for CVE-2021-4460

Threats

Impact moderate

CVE-2023-53648

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected products

Recommended 56 products, the same list as for CVE-2021-4460

Threats

Impact moderate

CVE-2023-53650

4.7 (Medium)


                
                  CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected products

Recommended 56 products, the same list as for CVE-2021-4460

Threats

Impact moderate

CVE-2023-53667

6.1 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H

Affected products

Recommended 56 products, the same list as for CVE-2021-4460

Threats

Impact moderate

CVE-2023-53668

4.4 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

Affected products

Recommended 56 products, the same list as for CVE-2021-4460

Threats

Impact moderate

CVE-2023-53672

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected products

Recommended 56 products, the same list as for CVE-2021-4460

Threats

Impact moderate

CVE-2023-53675

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected products

Recommended 56 products, the same list as for CVE-2021-4460

Threats

Impact moderate

CVE-2023-53681

4.4 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

Affected products

Recommended 56 products, the same list as for CVE-2021-4460

Threats

Impact moderate

CVE-2023-53683

3.3 (Low)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

Affected products

Recommended 56 products, the same list as for CVE-2021-4460

Threats

Impact moderate

CVE-2023-53687

3.3 (Low)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

Affected products

Recommended 56 products, the same list as for CVE-2021-4460

Threats

Impact low

CVE-2023-53695

6.3 (Medium)


                
                  CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:H

Affected products

Recommended 56 products, the same list as for CVE-2021-4460

Threats

Impact moderate

CVE-2023-53696

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected products

Recommended 56 products, the same list as for CVE-2021-4460

Threats

Impact moderate

CVE-2023-53705

6.5 (Medium)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L

Affected products

Recommended 56 products, the same list as for CVE-2021-4460

Threats

Impact moderate

CVE-2023-53707

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected products

Recommended 56 products, the same list as for CVE-2021-4460

Threats

Impact moderate

CVE-2023-53715

6.5 (Medium)


                
                  CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Affected products

Recommended 56 products, the same list as for CVE-2021-4460

Threats

Impact moderate

CVE-2023-53717

7 (High)


                
                  CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected products

Recommended 56 products, the same list as for CVE-2021-4460

Threats

Impact important

CVE-2023-53722

7.8 (High)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected products

Recommended 56 products, the same list as for CVE-2021-4460

Threats

Impact important

CVE-2023-53733

3.3 (Low)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Affected products

Recommended 56 products, the same list as for CVE-2021-4460

Threats

Impact low

CVE-2023-7324

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected products

Recommended 56 products, the same list as for CVE-2021-4460

Threats

Impact moderate

CVE-2024-56633

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected products

Recommended 56 products, the same list as for CVE-2021-4460

Threats

Impact moderate

CVE-2025-38539

5.3 (Medium)


                
                  CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H

Affected products

Recommended 56 products, the same list as for CVE-2021-4460

Threats

Impact moderate

CVE-2025-38680

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected products

Recommended 56 products, the same list as for CVE-2021-4460

Threats

Impact moderate

CVE-2025-38691

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected products

Recommended 56 products, the same list as for CVE-2021-4460

Threats

Impact moderate

CVE-2025-38695

4.7 (Medium)


                
                  CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:H

Affected products

Recommended 56 products, the same list as for CVE-2021-4460

Threats

Impact moderate

CVE-2025-38699

5.1 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H

Affected products

Recommended 56 products, the same list as for CVE-2021-4460

Threats

Impact moderate

CVE-2025-38700

5.8 (Medium)


                
                  CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:H

Affected products

Recommended 56 products, the same list as for CVE-2021-4460

Threats

Impact moderate

CVE-2025-38714

6.3 (Medium)


                
                  CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H

Affected products

Recommended 56 products, the same list as for CVE-2021-4460

Threats

Impact moderate

CVE-2025-38718

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected products

Recommended 56 products, the same list as for CVE-2021-4460

Threats

Impact moderate

CVE-2025-38724

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected products

Recommended 56 products, the same list as for CVE-2021-4460

Threats

Impact moderate

CVE-2025-39676

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected products

Recommended 56 products, the same list as for CVE-2021-4460

Threats

Impact moderate

CVE-2025-39702

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected products

Recommended 56 products, the same list as for CVE-2021-4460

Threats

Impact moderate

CVE-2025-39724

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected products

Recommended 56 products, the same list as for CVE-2021-4460

Threats

Impact moderate

CVE-2025-39756

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected products

Recommended 56 products, the same list as for CVE-2021-4460

Threats

Impact moderate

CVE-2025-39772

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected products

Recommended 56 products, the same list as for CVE-2021-4460

Threats

Impact moderate

CVE-2025-39812

5.3 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Affected products

Recommended 56 products, the same list as for CVE-2021-4460

Threats

Impact moderate

CVE-2025-39813

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected products

Recommended 56 products, the same list as for CVE-2021-4460

Threats

Impact moderate

CVE-2025-39841

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected products

Recommended 56 products, the same list as for CVE-2021-4460

Threats

Impact moderate

CVE-2025-39866

6.4 (Medium)


                
                  CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H

Affected products

Recommended 56 products, the same list as for CVE-2021-4460

Threats

Impact moderate

CVE-2025-39876

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected products

Recommended 56 products, the same list as for CVE-2021-4460

Threats

Impact moderate

CVE-2025-39911

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected products

Recommended 56 products, the same list as for CVE-2021-4460

Threats

Impact moderate

CVE-2025-39923

6.1 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H

Affected products

Recommended 56 products, the same list as for CVE-2021-4460

Threats

Impact moderate

CVE-2025-39929

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected products

Recommended 56 products, the same list as for CVE-2021-4460

Threats

Impact moderate

CVE-2025-39931

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected products

Recommended 56 products, the same list as for CVE-2021-4460

Threats

Impact moderate

CVE-2025-39945

6.4 (Medium)


                
                  CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H

Affected products

Recommended 56 products, the same list as for CVE-2021-4460

Threats

Impact moderate

CVE-2025-39949

6.1 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H

Affected products

Recommended 56 products, the same list as for CVE-2021-4460

Threats

Impact moderate

CVE-2025-39955

6.1 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H

Affected products

Recommended 56 products, the same list as for CVE-2021-4460

Threats

Impact moderate

CVE-2025-39968

3.3 (Low)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

Affected products

Recommended 56 products, the same list as for CVE-2021-4460

Threats

Impact low

CVE-2025-39970

6.1 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H

Affected products

Recommended 56 products, the same list as for CVE-2021-4460

Threats

Impact moderate

CVE-2025-39971

6.6 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H

Affected products

Recommended 56 products, the same list as for CVE-2021-4460

Threats

Impact moderate

CVE-2025-39972

6.1 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H

Affected products

Recommended 56 products, the same list as for CVE-2021-4460

Threats

Impact moderate

CVE-2025-39973

7 (High)


                
                  CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected products

Recommended 56 products, the same list as for CVE-2021-4460

Threats

Impact important

CVE-2025-39997

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected products

Recommended 56 products, the same list as for CVE-2021-4460

Threats

Impact moderate

CVE-2025-40018

7 (High)


                
                  CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected products

Recommended 56 products, the same list as for CVE-2021-4460

Threats

Impact important

CVE-2025-40044

6.3 (Medium)


                
                  CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:H

Affected products

Recommended 56 products, the same list as for CVE-2021-4460

Threats

Impact moderate

CVE-2025-40049

6.1 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H

Affected products

Recommended 56 products, the same list as for CVE-2021-4460

Threats

Impact moderate

CVE-2025-40078

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected products

Recommended 56 products, the same list as for CVE-2021-4460

Threats

Impact moderate

CVE-2025-40082

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected products

Recommended 56 products, the same list as for CVE-2021-4460

Threats

Impact moderate

CVE-2025-40088

5.3 (Medium)


                
                  CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:H

Affected products

Recommended 56 products, the same list as for CVE-2021-4460

Threats

Impact moderate

References

581 references

URL	Category
https://www.suse.com/support/security/rating/	external
https://ftp.suse.com/pub/projects/security/csaf/s…	self
https://www.suse.com/support/update/announcement/…	self
https://lists.suse.com/pipermail/sle-security-upd…	self
https://bugzilla.suse.com/1065729	self
https://bugzilla.suse.com/1154048	self
https://bugzilla.suse.com/1205128	self
https://bugzilla.suse.com/1210124	self
https://bugzilla.suse.com/1212175	self
https://bugzilla.suse.com/1213747	self
https://bugzilla.suse.com/1215136	self
https://bugzilla.suse.com/1215152	self
https://bugzilla.suse.com/1223475	self
https://bugzilla.suse.com/1235485	self
https://bugzilla.suse.com/1247518	self
https://bugzilla.suse.com/1248211	self
https://bugzilla.suse.com/1249161	self
https://bugzilla.suse.com/1249169	self
https://bugzilla.suse.com/1249182	self
https://bugzilla.suse.com/1249203	self
https://bugzilla.suse.com/1249215	self
https://bugzilla.suse.com/1249224	self
https://bugzilla.suse.com/1249260	self
https://bugzilla.suse.com/1249265	self
https://bugzilla.suse.com/1249285	self
https://bugzilla.suse.com/1249302	self
https://bugzilla.suse.com/1249317	self
https://bugzilla.suse.com/1249506	self
https://bugzilla.suse.com/1249512	self
https://bugzilla.suse.com/1249682	self
https://bugzilla.suse.com/1249702	self
https://bugzilla.suse.com/1249721	self
https://bugzilla.suse.com/1249747	self
https://bugzilla.suse.com/1249752	self
https://bugzilla.suse.com/1249806	self
https://bugzilla.suse.com/1249820	self
https://bugzilla.suse.com/1249854	self
https://bugzilla.suse.com/1249859	self
https://bugzilla.suse.com/1249863	self
https://bugzilla.suse.com/1249916	self
https://bugzilla.suse.com/1249941	self
https://bugzilla.suse.com/1250032	self
https://bugzilla.suse.com/1250040	self
https://bugzilla.suse.com/1250074	self
https://bugzilla.suse.com/1250107	self
https://bugzilla.suse.com/1250137	self
https://bugzilla.suse.com/1250163	self
https://bugzilla.suse.com/1250164	self
https://bugzilla.suse.com/1250202	self
https://bugzilla.suse.com/1250211	self
https://bugzilla.suse.com/1250261	self
https://bugzilla.suse.com/1250274	self
https://bugzilla.suse.com/1250277	self
https://bugzilla.suse.com/1250311	self
https://bugzilla.suse.com/1250329	self
https://bugzilla.suse.com/1250400	self
https://bugzilla.suse.com/1250455	self
https://bugzilla.suse.com/1250704	self
https://bugzilla.suse.com/1250741	self
https://bugzilla.suse.com/1250742	self
https://bugzilla.suse.com/1250764	self
https://bugzilla.suse.com/1250768	self
https://bugzilla.suse.com/1250784	self
https://bugzilla.suse.com/1250839	self
https://bugzilla.suse.com/1250840	self
https://bugzilla.suse.com/1250850	self
https://bugzilla.suse.com/1250895	self
https://bugzilla.suse.com/1250919	self
https://bugzilla.suse.com/1250946	self
https://bugzilla.suse.com/1250964	self
https://bugzilla.suse.com/1251035	self
https://bugzilla.suse.com/1251036	self
https://bugzilla.suse.com/1251051	self
https://bugzilla.suse.com/1251052	self
https://bugzilla.suse.com/1251053	self
https://bugzilla.suse.com/1251059	self
https://bugzilla.suse.com/1251061	self
https://bugzilla.suse.com/1251066	self
https://bugzilla.suse.com/1251072	self
https://bugzilla.suse.com/1251080	self
https://bugzilla.suse.com/1251086	self
https://bugzilla.suse.com/1251088	self
https://bugzilla.suse.com/1251091	self
https://bugzilla.suse.com/1251099	self
https://bugzilla.suse.com/1251100	self
https://bugzilla.suse.com/1251113	self
https://bugzilla.suse.com/1251123	self
https://bugzilla.suse.com/1251128	self
https://bugzilla.suse.com/1251129	self
https://bugzilla.suse.com/1251132	self
https://bugzilla.suse.com/1251161	self
https://bugzilla.suse.com/1251166	self
https://bugzilla.suse.com/1251177	self
https://bugzilla.suse.com/1251180	self
https://bugzilla.suse.com/1251182	self
https://bugzilla.suse.com/1251197	self
https://bugzilla.suse.com/1251202	self
https://bugzilla.suse.com/1251208	self
https://bugzilla.suse.com/1251210	self
https://bugzilla.suse.com/1251230	self
https://bugzilla.suse.com/1251283	self
https://bugzilla.suse.com/1251286	self
https://bugzilla.suse.com/1251292	self
https://bugzilla.suse.com/1251293	self
https://bugzilla.suse.com/1251294	self
https://bugzilla.suse.com/1251300	self
https://bugzilla.suse.com/1251325	self
https://bugzilla.suse.com/1251329	self
https://bugzilla.suse.com/1251330	self
https://bugzilla.suse.com/1251333	self
https://bugzilla.suse.com/1251522	self
https://bugzilla.suse.com/1251524	self
https://bugzilla.suse.com/1251550	self
https://bugzilla.suse.com/1251725	self
https://bugzilla.suse.com/1251732	self
https://bugzilla.suse.com/1251736	self
https://bugzilla.suse.com/1251741	self
https://bugzilla.suse.com/1251743	self
https://bugzilla.suse.com/1251750	self
https://bugzilla.suse.com/1251761	self
https://bugzilla.suse.com/1251769	self
https://bugzilla.suse.com/1251772	self
https://bugzilla.suse.com/1251777	self
https://bugzilla.suse.com/1251780	self
https://bugzilla.suse.com/1251804	self
https://bugzilla.suse.com/1251930	self
https://bugzilla.suse.com/1252035	self
https://bugzilla.suse.com/1252039	self
https://bugzilla.suse.com/1252047	self
https://bugzilla.suse.com/1252051	self
https://bugzilla.suse.com/1252052	self
https://bugzilla.suse.com/1252056	self
https://bugzilla.suse.com/1252265	self
https://bugzilla.suse.com/1252480	self
https://bugzilla.suse.com/1252487	self
https://bugzilla.suse.com/1252499	self
https://bugzilla.suse.com/1252513	self
https://bugzilla.suse.com/1252538	self
https://bugzilla.suse.com/1252539	self
https://bugzilla.suse.com/1252545	self
https://bugzilla.suse.com/1252549	self
https://bugzilla.suse.com/1252554	self
https://bugzilla.suse.com/1252560	self
https://bugzilla.suse.com/1252632	self
https://bugzilla.suse.com/1252685	self
https://bugzilla.suse.com/1252688	self
https://bugzilla.suse.com/1252775	self
https://bugzilla.suse.com/1252785	self
https://bugzilla.suse.com/1252789	self
https://bugzilla.suse.com/1252822	self
https://bugzilla.suse.com/1252893	self
https://bugzilla.suse.com/1252904	self
https://bugzilla.suse.com/1252909	self
https://www.suse.com/security/cve/CVE-2021-4460/	self
https://www.suse.com/security/cve/CVE-2022-43945/	self
https://www.suse.com/security/cve/CVE-2022-48631/	self
https://www.suse.com/security/cve/CVE-2022-50236/	self
https://www.suse.com/security/cve/CVE-2022-50249/	self
https://www.suse.com/security/cve/CVE-2022-50280/	self
https://www.suse.com/security/cve/CVE-2022-50293/	self
https://www.suse.com/security/cve/CVE-2022-50327/	self
https://www.suse.com/security/cve/CVE-2022-50350/	self
https://www.suse.com/security/cve/CVE-2022-50356/	self
https://www.suse.com/security/cve/CVE-2022-50367/	self
https://www.suse.com/security/cve/CVE-2022-50394/	self
https://www.suse.com/security/cve/CVE-2022-50395/	self
https://www.suse.com/security/cve/CVE-2022-50423/	self
https://www.suse.com/security/cve/CVE-2022-50443/	self
https://www.suse.com/security/cve/CVE-2022-50459/	self
https://www.suse.com/security/cve/CVE-2022-50470/	self
https://www.suse.com/security/cve/CVE-2022-50481/	self
https://www.suse.com/security/cve/CVE-2022-50485/	self
https://www.suse.com/security/cve/CVE-2022-50487/	self
https://www.suse.com/security/cve/CVE-2022-50493/	self
https://www.suse.com/security/cve/CVE-2022-50496/	self
https://www.suse.com/security/cve/CVE-2022-50501/	self
https://www.suse.com/security/cve/CVE-2022-50504/	self
https://www.suse.com/security/cve/CVE-2022-50505/	self
https://www.suse.com/security/cve/CVE-2022-50509/	self
https://www.suse.com/security/cve/CVE-2022-50516/	self
https://www.suse.com/security/cve/CVE-2022-50532/	self
https://www.suse.com/security/cve/CVE-2022-50534/	self
https://www.suse.com/security/cve/CVE-2022-50536/	self
https://www.suse.com/security/cve/CVE-2022-50537/	self
https://www.suse.com/security/cve/CVE-2022-50542/	self
https://www.suse.com/security/cve/CVE-2022-50544/	self
https://www.suse.com/security/cve/CVE-2022-50549/	self
https://www.suse.com/security/cve/CVE-2022-50563/	self
https://www.suse.com/security/cve/CVE-2022-50564/	self
https://www.suse.com/security/cve/CVE-2022-50571/	self
https://www.suse.com/security/cve/CVE-2022-50581/	self
https://www.suse.com/security/cve/CVE-2023-53183/	self
https://www.suse.com/security/cve/CVE-2023-53185/	self
https://www.suse.com/security/cve/CVE-2023-53188/	self
https://www.suse.com/security/cve/CVE-2023-53191/	self
https://www.suse.com/security/cve/CVE-2023-53204/	self
https://www.suse.com/security/cve/CVE-2023-53271/	self
https://www.suse.com/security/cve/CVE-2023-53282/	self
https://www.suse.com/security/cve/CVE-2023-53289/	self
https://www.suse.com/security/cve/CVE-2023-53292/	self
https://www.suse.com/security/cve/CVE-2023-53338/	self
https://www.suse.com/security/cve/CVE-2023-53339/	self
https://www.suse.com/security/cve/CVE-2023-53373/	self
https://www.suse.com/security/cve/CVE-2023-53433/	self
https://www.suse.com/security/cve/CVE-2023-53476/	self
https://www.suse.com/security/cve/CVE-2023-53477/	self
https://www.suse.com/security/cve/CVE-2023-53484/	self
https://www.suse.com/security/cve/CVE-2023-53517/	self
https://www.suse.com/security/cve/CVE-2023-53519/	self
https://www.suse.com/security/cve/CVE-2023-53533/	self
https://www.suse.com/security/cve/CVE-2023-53540/	self
https://www.suse.com/security/cve/CVE-2023-53548/	self
https://www.suse.com/security/cve/CVE-2023-53556/	self
https://www.suse.com/security/cve/CVE-2023-53559/	self
https://www.suse.com/security/cve/CVE-2023-53564/	self
https://www.suse.com/security/cve/CVE-2023-53568/	self
https://www.suse.com/security/cve/CVE-2023-53582/	self
https://www.suse.com/security/cve/CVE-2023-53587/	self
https://www.suse.com/security/cve/CVE-2023-53589/	self
https://www.suse.com/security/cve/CVE-2023-53593/	self
https://www.suse.com/security/cve/CVE-2023-53594/	self
https://www.suse.com/security/cve/CVE-2023-53596/	self
https://www.suse.com/security/cve/CVE-2023-53603/	self
https://www.suse.com/security/cve/CVE-2023-53604/	self
https://www.suse.com/security/cve/CVE-2023-53611/	self
https://www.suse.com/security/cve/CVE-2023-53615/	self
https://www.suse.com/security/cve/CVE-2023-53619/	self
https://www.suse.com/security/cve/CVE-2023-53620/	self
https://www.suse.com/security/cve/CVE-2023-53622/	self
https://www.suse.com/security/cve/CVE-2023-53624/	self
https://www.suse.com/security/cve/CVE-2023-53635/	self
https://www.suse.com/security/cve/CVE-2023-53644/	self
https://www.suse.com/security/cve/CVE-2023-53647/	self
https://www.suse.com/security/cve/CVE-2023-53648/	self
https://www.suse.com/security/cve/CVE-2023-53650/	self
https://www.suse.com/security/cve/CVE-2023-53667/	self
https://www.suse.com/security/cve/CVE-2023-53668/	self
https://www.suse.com/security/cve/CVE-2023-53672/	self
https://www.suse.com/security/cve/CVE-2023-53675/	self
https://www.suse.com/security/cve/CVE-2023-53681/	self
https://www.suse.com/security/cve/CVE-2023-53683/	self
https://www.suse.com/security/cve/CVE-2023-53687/	self
https://www.suse.com/security/cve/CVE-2023-53695/	self
https://www.suse.com/security/cve/CVE-2023-53696/	self
https://www.suse.com/security/cve/CVE-2023-53705/	self
https://www.suse.com/security/cve/CVE-2023-53707/	self
https://www.suse.com/security/cve/CVE-2023-53715/	self
https://www.suse.com/security/cve/CVE-2023-53717/	self
https://www.suse.com/security/cve/CVE-2023-53722/	self
https://www.suse.com/security/cve/CVE-2023-53733/	self
https://www.suse.com/security/cve/CVE-2023-7324/	self
https://www.suse.com/security/cve/CVE-2024-56633/	self
https://www.suse.com/security/cve/CVE-2025-38539/	self
https://www.suse.com/security/cve/CVE-2025-38680/	self
https://www.suse.com/security/cve/CVE-2025-38691/	self
https://www.suse.com/security/cve/CVE-2025-38695/	self
https://www.suse.com/security/cve/CVE-2025-38699/	self
https://www.suse.com/security/cve/CVE-2025-38700/	self
https://www.suse.com/security/cve/CVE-2025-38714/	self
https://www.suse.com/security/cve/CVE-2025-38718/	self
https://www.suse.com/security/cve/CVE-2025-38724/	self
https://www.suse.com/security/cve/CVE-2025-39676/	self
https://www.suse.com/security/cve/CVE-2025-39702/	self
https://www.suse.com/security/cve/CVE-2025-39724/	self
https://www.suse.com/security/cve/CVE-2025-39756/	self
https://www.suse.com/security/cve/CVE-2025-39772/	self
https://www.suse.com/security/cve/CVE-2025-39812/	self
https://www.suse.com/security/cve/CVE-2025-39813/	self
https://www.suse.com/security/cve/CVE-2025-39841/	self
https://www.suse.com/security/cve/CVE-2025-39866/	self
https://www.suse.com/security/cve/CVE-2025-39876/	self
https://www.suse.com/security/cve/CVE-2025-39911/	self
https://www.suse.com/security/cve/CVE-2025-39923/	self
https://www.suse.com/security/cve/CVE-2025-39929/	self
https://www.suse.com/security/cve/CVE-2025-39931/	self
https://www.suse.com/security/cve/CVE-2025-39945/	self
https://www.suse.com/security/cve/CVE-2025-39949/	self
https://www.suse.com/security/cve/CVE-2025-39955/	self
https://www.suse.com/security/cve/CVE-2025-39968/	self
https://www.suse.com/security/cve/CVE-2025-39970/	self
https://www.suse.com/security/cve/CVE-2025-39971/	self
https://www.suse.com/security/cve/CVE-2025-39972/	self
https://www.suse.com/security/cve/CVE-2025-39973/	self
https://www.suse.com/security/cve/CVE-2025-39997/	self
https://www.suse.com/security/cve/CVE-2025-40018/	self
https://www.suse.com/security/cve/CVE-2025-40044/	self
https://www.suse.com/security/cve/CVE-2025-40049/	self
https://www.suse.com/security/cve/CVE-2025-40078/	self
https://www.suse.com/security/cve/CVE-2025-40082/	self
https://www.suse.com/security/cve/CVE-2025-40088/	self
https://www.suse.com/security/cve/CVE-2021-4460	external
https://bugzilla.suse.com/1250764	external
https://www.suse.com/security/cve/CVE-2022-43945	external
https://bugzilla.suse.com/1205128	external
https://bugzilla.suse.com/1205130	external
https://bugzilla.suse.com/1208030	external
https://bugzilla.suse.com/1208085	external
https://bugzilla.suse.com/1209225	external
https://bugzilla.suse.com/1210124	external
https://www.suse.com/security/cve/CVE-2022-48631	external
https://bugzilla.suse.com/1223475	external
https://www.suse.com/security/cve/CVE-2022-50236	external
https://bugzilla.suse.com/1249702	external
https://www.suse.com/security/cve/CVE-2022-50249	external
https://bugzilla.suse.com/1249747	external
https://www.suse.com/security/cve/CVE-2022-50280	external
https://bugzilla.suse.com/1249806	external
https://www.suse.com/security/cve/CVE-2022-50293	external
https://bugzilla.suse.com/1249752	external
https://www.suse.com/security/cve/CVE-2022-50327	external
https://bugzilla.suse.com/1249859	external
https://bugzilla.suse.com/1254451	external
https://www.suse.com/security/cve/CVE-2022-50350	external
https://bugzilla.suse.com/1250261	external
https://www.suse.com/security/cve/CVE-2022-50356	external
https://bugzilla.suse.com/1250040	external
https://www.suse.com/security/cve/CVE-2022-50367	external
https://bugzilla.suse.com/1247374	external
https://bugzilla.suse.com/1250277	external
https://www.suse.com/security/cve/CVE-2022-50394	external
https://bugzilla.suse.com/1250107	external
https://www.suse.com/security/cve/CVE-2022-50395	external
https://bugzilla.suse.com/1250211	external
https://www.suse.com/security/cve/CVE-2022-50423	external
https://bugzilla.suse.com/1250784	external
https://bugzilla.suse.com/1250785	external
https://www.suse.com/security/cve/CVE-2022-50443	external
https://bugzilla.suse.com/1250768	external
https://www.suse.com/security/cve/CVE-2022-50459	external
https://bugzilla.suse.com/1250850	external
https://www.suse.com/security/cve/CVE-2022-50470	external
https://bugzilla.suse.com/1251202	external
https://www.suse.com/security/cve/CVE-2022-50481	external
https://bugzilla.suse.com/1251051	external
https://www.suse.com/security/cve/CVE-2022-50485	external
https://bugzilla.suse.com/1251197	external
https://www.suse.com/security/cve/CVE-2022-50487	external
https://bugzilla.suse.com/1251208	external
https://www.suse.com/security/cve/CVE-2022-50493	external
https://bugzilla.suse.com/1251088	external
https://www.suse.com/security/cve/CVE-2022-50496	external
https://bugzilla.suse.com/1251091	external
https://www.suse.com/security/cve/CVE-2022-50501	external
https://bugzilla.suse.com/1251099	external
https://www.suse.com/security/cve/CVE-2022-50504	external
https://bugzilla.suse.com/1251182	external
https://www.suse.com/security/cve/CVE-2022-50505	external
https://bugzilla.suse.com/1251086	external
https://www.suse.com/security/cve/CVE-2022-50509	external
https://bugzilla.suse.com/1251522	external
https://www.suse.com/security/cve/CVE-2022-50516	external
https://bugzilla.suse.com/1251741	external
https://www.suse.com/security/cve/CVE-2022-50532	external
https://bugzilla.suse.com/1251300	external
https://www.suse.com/security/cve/CVE-2022-50534	external
https://bugzilla.suse.com/1251292	external
https://www.suse.com/security/cve/CVE-2022-50536	external
https://bugzilla.suse.com/1251293	external
https://www.suse.com/security/cve/CVE-2022-50537	external
https://bugzilla.suse.com/1251294	external
https://www.suse.com/security/cve/CVE-2022-50542	external
https://bugzilla.suse.com/1251330	external
https://www.suse.com/security/cve/CVE-2022-50544	external
https://bugzilla.suse.com/1251725	external
https://www.suse.com/security/cve/CVE-2022-50549	external
https://bugzilla.suse.com/1251550	external
https://www.suse.com/security/cve/CVE-2022-50563	external
https://bugzilla.suse.com/1252480	external
https://www.suse.com/security/cve/CVE-2022-50564	external
https://bugzilla.suse.com/1252538	external
https://www.suse.com/security/cve/CVE-2022-50571	external
https://bugzilla.suse.com/1252487	external
https://www.suse.com/security/cve/CVE-2022-50581	external
https://bugzilla.suse.com/1252549	external
https://www.suse.com/security/cve/CVE-2023-53183	external
https://bugzilla.suse.com/1249863	external
https://www.suse.com/security/cve/CVE-2023-53185	external
https://bugzilla.suse.com/1249820	external
https://www.suse.com/security/cve/CVE-2023-53188	external
https://bugzilla.suse.com/1249854	external
https://www.suse.com/security/cve/CVE-2023-53191	external
https://bugzilla.suse.com/1249721	external
https://www.suse.com/security/cve/CVE-2023-53204	external
https://bugzilla.suse.com/1249682	external
https://www.suse.com/security/cve/CVE-2023-53271	external
https://bugzilla.suse.com/1249916	external
https://www.suse.com/security/cve/CVE-2023-53282	external
https://bugzilla.suse.com/1250311	external
https://www.suse.com/security/cve/CVE-2023-53289	external
https://bugzilla.suse.com/1249941	external
https://www.suse.com/security/cve/CVE-2023-53292	external
https://bugzilla.suse.com/1250163	external
https://www.suse.com/security/cve/CVE-2023-53338	external
https://bugzilla.suse.com/1250074	external
https://www.suse.com/security/cve/CVE-2023-53339	external
https://bugzilla.suse.com/1250329	external
https://www.suse.com/security/cve/CVE-2023-53373	external
https://bugzilla.suse.com/1250137	external
https://www.suse.com/security/cve/CVE-2023-53433	external
https://bugzilla.suse.com/1250164	external
https://www.suse.com/security/cve/CVE-2023-53476	external
https://bugzilla.suse.com/1250839	external
https://www.suse.com/security/cve/CVE-2023-53477	external
https://bugzilla.suse.com/1250840	external
https://www.suse.com/security/cve/CVE-2023-53484	external
https://bugzilla.suse.com/1250895	external
https://www.suse.com/security/cve/CVE-2023-53517	external
https://bugzilla.suse.com/1250919	external
https://www.suse.com/security/cve/CVE-2023-53519	external
https://bugzilla.suse.com/1250964	external
https://www.suse.com/security/cve/CVE-2023-53533	external
https://bugzilla.suse.com/1251080	external
https://www.suse.com/security/cve/CVE-2023-53540	external
https://bugzilla.suse.com/1251053	external
https://www.suse.com/security/cve/CVE-2023-53548	external
https://bugzilla.suse.com/1251066	external
https://www.suse.com/security/cve/CVE-2023-53556	external
https://bugzilla.suse.com/1251059	external
https://www.suse.com/security/cve/CVE-2023-53559	external
https://bugzilla.suse.com/1251052	external
https://www.suse.com/security/cve/CVE-2023-53564	external
https://bugzilla.suse.com/1251072	external
https://www.suse.com/security/cve/CVE-2023-53568	external
https://bugzilla.suse.com/1251035	external
https://www.suse.com/security/cve/CVE-2023-53582	external
https://bugzilla.suse.com/1251061	external
https://www.suse.com/security/cve/CVE-2023-53587	external
https://bugzilla.suse.com/1251128	external
https://www.suse.com/security/cve/CVE-2023-53589	external
https://bugzilla.suse.com/1251129	external
https://www.suse.com/security/cve/CVE-2023-53593	external
https://bugzilla.suse.com/1251132	external
https://www.suse.com/security/cve/CVE-2023-53594	external
https://bugzilla.suse.com/1251166	external
https://www.suse.com/security/cve/CVE-2023-53596	external
https://bugzilla.suse.com/1251161	external
https://www.suse.com/security/cve/CVE-2023-53603	external
https://bugzilla.suse.com/1251180	external
https://www.suse.com/security/cve/CVE-2023-53604	external
https://bugzilla.suse.com/1251210	external
https://www.suse.com/security/cve/CVE-2023-53611	external
https://bugzilla.suse.com/1251123	external
https://www.suse.com/security/cve/CVE-2023-53615	external
https://bugzilla.suse.com/1251113	external
https://www.suse.com/security/cve/CVE-2023-53619	external
https://bugzilla.suse.com/1251743	external
https://bugzilla.suse.com/1251745	external
https://www.suse.com/security/cve/CVE-2023-53620	external
https://bugzilla.suse.com/1251318	external
https://www.suse.com/security/cve/CVE-2023-53622	external
https://bugzilla.suse.com/1251777	external
https://www.suse.com/security/cve/CVE-2023-53624	external
https://bugzilla.suse.com/1251333	external
https://www.suse.com/security/cve/CVE-2023-53635	external
https://bugzilla.suse.com/1251524	external
https://www.suse.com/security/cve/CVE-2023-53644	external
https://bugzilla.suse.com/1251736	external
https://www.suse.com/security/cve/CVE-2023-53647	external
https://bugzilla.suse.com/1251732	external
https://www.suse.com/security/cve/CVE-2023-53648	external
https://bugzilla.suse.com/1251750	external
https://www.suse.com/security/cve/CVE-2023-53650	external
https://bugzilla.suse.com/1251283	external
https://www.suse.com/security/cve/CVE-2023-53667	external
https://bugzilla.suse.com/1251761	external
https://www.suse.com/security/cve/CVE-2023-53668	external
https://bugzilla.suse.com/1251286	external
https://www.suse.com/security/cve/CVE-2023-53672	external
https://bugzilla.suse.com/1251780	external
https://www.suse.com/security/cve/CVE-2023-53675	external
https://bugzilla.suse.com/1251325	external
https://www.suse.com/security/cve/CVE-2023-53681	external
https://bugzilla.suse.com/1251769	external
https://www.suse.com/security/cve/CVE-2023-53683	external
https://bugzilla.suse.com/1251329	external
https://www.suse.com/security/cve/CVE-2023-53687	external
https://bugzilla.suse.com/1251772	external
https://www.suse.com/security/cve/CVE-2023-53695	external
https://bugzilla.suse.com/1252539	external
https://www.suse.com/security/cve/CVE-2023-53696	external
https://bugzilla.suse.com/1252513	external
https://www.suse.com/security/cve/CVE-2023-53705	external
https://bugzilla.suse.com/1252554	external
https://www.suse.com/security/cve/CVE-2023-53707	external
https://bugzilla.suse.com/1252632	external
https://www.suse.com/security/cve/CVE-2023-53715	external
https://bugzilla.suse.com/1252545	external
https://www.suse.com/security/cve/CVE-2023-53717	external
https://bugzilla.suse.com/1252560	external
https://bugzilla.suse.com/1252563	external
https://www.suse.com/security/cve/CVE-2023-53722	external
https://bugzilla.suse.com/1252499	external
https://bugzilla.suse.com/1252500	external
https://www.suse.com/security/cve/CVE-2023-53733	external
https://bugzilla.suse.com/1252685	external
https://www.suse.com/security/cve/CVE-2023-7324	external
https://bugzilla.suse.com/1252893	external
https://www.suse.com/security/cve/CVE-2024-56633	external
https://bugzilla.suse.com/1235485	external
https://www.suse.com/security/cve/CVE-2025-38539	external
https://bugzilla.suse.com/1248211	external
https://www.suse.com/security/cve/CVE-2025-38680	external
https://bugzilla.suse.com/1249203	external
https://www.suse.com/security/cve/CVE-2025-38691	external
https://bugzilla.suse.com/1249215	external
https://www.suse.com/security/cve/CVE-2025-38695	external
https://bugzilla.suse.com/1249285	external
https://www.suse.com/security/cve/CVE-2025-38699	external
https://bugzilla.suse.com/1249224	external
https://www.suse.com/security/cve/CVE-2025-38700	external
https://bugzilla.suse.com/1249182	external
https://www.suse.com/security/cve/CVE-2025-38714	external
https://bugzilla.suse.com/1249260	external
https://bugzilla.suse.com/1249596	external
https://www.suse.com/security/cve/CVE-2025-38718	external
https://bugzilla.suse.com/1249161	external
https://www.suse.com/security/cve/CVE-2025-38724	external
https://bugzilla.suse.com/1249169	external
https://www.suse.com/security/cve/CVE-2025-39676	external
https://bugzilla.suse.com/1249302	external
https://www.suse.com/security/cve/CVE-2025-39702	external
https://bugzilla.suse.com/1249317	external
https://www.suse.com/security/cve/CVE-2025-39724	external
https://bugzilla.suse.com/1249265	external
https://www.suse.com/security/cve/CVE-2025-39756	external
https://bugzilla.suse.com/1249512	external
https://www.suse.com/security/cve/CVE-2025-39772	external
https://bugzilla.suse.com/1249506	external
https://www.suse.com/security/cve/CVE-2025-39812	external
https://bugzilla.suse.com/1250202	external
https://www.suse.com/security/cve/CVE-2025-39813	external
https://bugzilla.suse.com/1250032	external
https://www.suse.com/security/cve/CVE-2025-39841	external
https://bugzilla.suse.com/1250274	external
https://www.suse.com/security/cve/CVE-2025-39866	external
https://bugzilla.suse.com/1250455	external
https://www.suse.com/security/cve/CVE-2025-39876	external
https://bugzilla.suse.com/1250400	external
https://www.suse.com/security/cve/CVE-2025-39911	external
https://bugzilla.suse.com/1250704	external
https://www.suse.com/security/cve/CVE-2025-39923	external
https://bugzilla.suse.com/1250741	external
https://www.suse.com/security/cve/CVE-2025-39929	external
https://bugzilla.suse.com/1251036	external
https://www.suse.com/security/cve/CVE-2025-39931	external
https://bugzilla.suse.com/1251100	external
https://www.suse.com/security/cve/CVE-2025-39945	external
https://bugzilla.suse.com/1251230	external
https://www.suse.com/security/cve/CVE-2025-39949	external
https://bugzilla.suse.com/1251177	external
https://www.suse.com/security/cve/CVE-2025-39955	external
https://bugzilla.suse.com/1251804	external
https://www.suse.com/security/cve/CVE-2025-39968	external
https://bugzilla.suse.com/1252047	external
https://www.suse.com/security/cve/CVE-2025-39970	external
https://bugzilla.suse.com/1252051	external
https://www.suse.com/security/cve/CVE-2025-39971	external
https://bugzilla.suse.com/1252052	external
https://www.suse.com/security/cve/CVE-2025-39972	external
https://bugzilla.suse.com/1252039	external
https://www.suse.com/security/cve/CVE-2025-39973	external
https://bugzilla.suse.com/1247374	external
https://bugzilla.suse.com/1252035	external
https://bugzilla.suse.com/1252036	external
https://www.suse.com/security/cve/CVE-2025-39997	external
https://bugzilla.suse.com/1252056	external
https://www.suse.com/security/cve/CVE-2025-40018	external
https://bugzilla.suse.com/1247374	external
https://bugzilla.suse.com/1252688	external
https://bugzilla.suse.com/1252689	external
https://bugzilla.suse.com/1253291	external
https://www.suse.com/security/cve/CVE-2025-40044	external
https://bugzilla.suse.com/1252785	external
https://www.suse.com/security/cve/CVE-2025-40049	external
https://bugzilla.suse.com/1252822	external
https://www.suse.com/security/cve/CVE-2025-40078	external
https://bugzilla.suse.com/1252789	external
https://www.suse.com/security/cve/CVE-2025-40082	external
https://bugzilla.suse.com/1252775	external
https://www.suse.com/security/cve/CVE-2025-40088	external
https://bugzilla.suse.com/1252904	external

JSON

To clipboard

Loading 2.7 MB of JSON…

CVE-2025-39724 (GCVE-0-2025-39724)

Vulnerability from cvelistv5 – Published: 2025-09-05 17:21 – Updated: 2026-07-14 12:42

Title

serial: 8250: fix panic due to PSLVERR

Summary

In the Linux kernel, the following vulnerability has been resolved: serial: 8250: fix panic due to PSLVERR When the PSLVERR_RESP_EN parameter is set to 1, the device generates an error response if an attempt is made to read an empty RBR (Receive Buffer Register) while the FIFO is enabled. In serial8250_do_startup(), calling serial_port_out(port, UART_LCR, UART_LCR_WLEN8) triggers dw8250_check_lcr(), which invokes dw8250_force_idle() and serial8250_clear_and_reinit_fifos(). The latter function enables the FIFO via serial_out(p, UART_FCR, p->fcr). Execution proceeds to the serial_port_in(port, UART_RX). This satisfies the PSLVERR trigger condition. When another CPU (e.g., using printk()) is accessing the UART (UART is busy), the current CPU fails the check (value & ~UART_LCR_SPAR) == (lcr & ~UART_LCR_SPAR) in dw8250_check_lcr(), causing it to enter dw8250_force_idle(). Put serial_port_out(port, UART_LCR, UART_LCR_WLEN8) under the port->lock to fix this issue. Panic backtrace: [ 0.442336] Oops - unknown exception [#1] [ 0.442343] epc : dw8250_serial_in32+0x1e/0x4a [ 0.442351] ra : serial8250_do_startup+0x2c8/0x88e ... [ 0.442416] console_on_rootfs+0x26/0x70

Severity

No CVSS data available.

Assigner

Linux mitre root

References

12 references

URL	Tags
https://git.kernel.org/stable/c/0b882f00655afefbc…
https://git.kernel.org/stable/c/b8ca8e3f75ede308b…
https://git.kernel.org/stable/c/68c4613e89f000e81…
https://git.kernel.org/stable/c/c826943abf473a3f7…
https://git.kernel.org/stable/c/cb7b3633ed749db8e…
https://git.kernel.org/stable/c/8e2739478c164147d…
https://git.kernel.org/stable/c/38c0ea484dedb58cb…
https://git.kernel.org/stable/c/7f8fdd4dbffc05982…
https://lists.debian.org/debian-lts-announce/2025…
https://lists.debian.org/debian-lts-announce/2025…
https://cert-portal.siemens.com/productcert/html/…
https://cert-portal.siemens.com/productcert/html/…

Impacted products

6 products

Vendor	Product	Version
Linux	Linux	Affected: c49436b657d0a56a6ad90d14a7c3041add7cf64d , < 0b882f00655afefbc7729c6b5aec86f7a5473a3d (git) Affected: c49436b657d0a56a6ad90d14a7c3041add7cf64d , < b8ca8e3f75ede308b4d49a6ca5081460be01bdb5 (git) Affected: c49436b657d0a56a6ad90d14a7c3041add7cf64d , < 68c4613e89f000e8198f9ace643082c697921c9f (git) Affected: c49436b657d0a56a6ad90d14a7c3041add7cf64d , < c826943abf473a3f7260fbadfad65e44db475460 (git) Affected: c49436b657d0a56a6ad90d14a7c3041add7cf64d , < cb7b3633ed749db8e56f475f43c960652cbd6882 (git) Affected: c49436b657d0a56a6ad90d14a7c3041add7cf64d , < 8e2739478c164147d0774802008528d9e03fb802 (git) Affected: c49436b657d0a56a6ad90d14a7c3041add7cf64d , < 38c0ea484dedb58cb3a4391229933e16be0d1031 (git) Affected: c49436b657d0a56a6ad90d14a7c3041add7cf64d , < 7f8fdd4dbffc05982b96caf586f77a014b2a9353 (git) Affected: 6d5e79331417886196cb3a733bdb6645ba85bc42 (git) Affected: 2401577586898b3590db80f8b97a26f81f0f6d4e (git) Affected: 3.10.48 , < 3.11 (semver) Affected: 3.12.24 , < 3.13 (semver)
Linux	Linux	Affected: 3.13 Unaffected: 0 , < 3.13 (semver) Unaffected: 5.4.297 , ≤ 5.4.* (semver) Unaffected: 5.10.241 , ≤ 5.10.* (semver) Unaffected: 5.15.190 , ≤ 5.15.* (semver) Unaffected: 6.1.149 , ≤ 6.1.* (semver) Unaffected: 6.6.103 , ≤ 6.6.* (semver) Unaffected: 6.12.44 , ≤ 6.12.* (semver) Unaffected: 6.16.4 , ≤ 6.16.* (semver) Unaffected: 6.17 , ≤ * (original_commit_for_fix)
Siemens	SIMATIC CN 4100	Affected: 0 , < V5.0 (custom)
Siemens	SIMATIC S7-1500 CPU 1518-4 PN/DP MFP	Affected: V3.1.5 , < * (custom)
Siemens	SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP	Affected: V3.1.5 , < * (custom)
Siemens	SIPLUS S7-1500 CPU 1518-4 PN/DP MFP	Affected: V3.1.5 , < * (custom)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T17:42:46.902Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html"
          },
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "affected": [
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC CN 4100",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V5.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.5",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.5",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.5",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.5",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.5",
                "versionType": "custom"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-14T12:42:43.256Z",
          "orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
          "shortName": "siemens-SADP"
        },
        "references": [
          {
            "url": "https://cert-portal.siemens.com/productcert/html/ssa-082556.html"
          },
          {
            "url": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html"
          }
        ],
        "x_adpType": "supplier"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/tty/serial/8250/8250_port.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "0b882f00655afefbc7729c6b5aec86f7a5473a3d",
              "status": "affected",
              "version": "c49436b657d0a56a6ad90d14a7c3041add7cf64d",
              "versionType": "git"
            },
            {
              "lessThan": "b8ca8e3f75ede308b4d49a6ca5081460be01bdb5",
              "status": "affected",
              "version": "c49436b657d0a56a6ad90d14a7c3041add7cf64d",
              "versionType": "git"
            },
            {
              "lessThan": "68c4613e89f000e8198f9ace643082c697921c9f",
              "status": "affected",
              "version": "c49436b657d0a56a6ad90d14a7c3041add7cf64d",
              "versionType": "git"
            },
            {
              "lessThan": "c826943abf473a3f7260fbadfad65e44db475460",
              "status": "affected",
              "version": "c49436b657d0a56a6ad90d14a7c3041add7cf64d",
              "versionType": "git"
            },
            {
              "lessThan": "cb7b3633ed749db8e56f475f43c960652cbd6882",
              "status": "affected",
              "version": "c49436b657d0a56a6ad90d14a7c3041add7cf64d",
              "versionType": "git"
            },
            {
              "lessThan": "8e2739478c164147d0774802008528d9e03fb802",
              "status": "affected",
              "version": "c49436b657d0a56a6ad90d14a7c3041add7cf64d",
              "versionType": "git"
            },
            {
              "lessThan": "38c0ea484dedb58cb3a4391229933e16be0d1031",
              "status": "affected",
              "version": "c49436b657d0a56a6ad90d14a7c3041add7cf64d",
              "versionType": "git"
            },
            {
              "lessThan": "7f8fdd4dbffc05982b96caf586f77a014b2a9353",
              "status": "affected",
              "version": "c49436b657d0a56a6ad90d14a7c3041add7cf64d",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "6d5e79331417886196cb3a733bdb6645ba85bc42",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "2401577586898b3590db80f8b97a26f81f0f6d4e",
              "versionType": "git"
            },
            {
              "lessThan": "3.11",
              "status": "affected",
              "version": "3.10.48",
              "versionType": "semver"
            },
            {
              "lessThan": "3.13",
              "status": "affected",
              "version": "3.12.24",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/tty/serial/8250/8250_port.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.13"
            },
            {
              "lessThan": "3.13",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.297",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.241",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.190",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.149",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.103",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.44",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.16.*",
              "status": "unaffected",
              "version": "6.16.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.17",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.297",
                  "versionStartIncluding": "3.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.241",
                  "versionStartIncluding": "3.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.190",
                  "versionStartIncluding": "3.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.149",
                  "versionStartIncluding": "3.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.103",
                  "versionStartIncluding": "3.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.44",
                  "versionStartIncluding": "3.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.16.4",
                  "versionStartIncluding": "3.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.17",
                  "versionStartIncluding": "3.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "3.10.48",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "3.12.24",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nserial: 8250: fix panic due to PSLVERR\n\nWhen the PSLVERR_RESP_EN parameter is set to 1, the device generates\nan error response if an attempt is made to read an empty RBR (Receive\nBuffer Register) while the FIFO is enabled.\n\nIn serial8250_do_startup(), calling serial_port_out(port, UART_LCR,\nUART_LCR_WLEN8) triggers dw8250_check_lcr(), which invokes\ndw8250_force_idle() and serial8250_clear_and_reinit_fifos(). The latter\nfunction enables the FIFO via serial_out(p, UART_FCR, p-\u003efcr).\nExecution proceeds to the serial_port_in(port, UART_RX).\nThis satisfies the PSLVERR trigger condition.\n\nWhen another CPU (e.g., using printk()) is accessing the UART (UART\nis busy), the current CPU fails the check (value \u0026 ~UART_LCR_SPAR) ==\n(lcr \u0026 ~UART_LCR_SPAR) in dw8250_check_lcr(), causing it to enter\ndw8250_force_idle().\n\nPut serial_port_out(port, UART_LCR, UART_LCR_WLEN8) under the port-\u003elock\nto fix this issue.\n\nPanic backtrace:\n[    0.442336] Oops - unknown exception [#1]\n[    0.442343] epc : dw8250_serial_in32+0x1e/0x4a\n[    0.442351]  ra : serial8250_do_startup+0x2c8/0x88e\n...\n[    0.442416] console_on_rootfs+0x26/0x70"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-23T16:00:33.986Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/0b882f00655afefbc7729c6b5aec86f7a5473a3d"
        },
        {
          "url": "https://git.kernel.org/stable/c/b8ca8e3f75ede308b4d49a6ca5081460be01bdb5"
        },
        {
          "url": "https://git.kernel.org/stable/c/68c4613e89f000e8198f9ace643082c697921c9f"
        },
        {
          "url": "https://git.kernel.org/stable/c/c826943abf473a3f7260fbadfad65e44db475460"
        },
        {
          "url": "https://git.kernel.org/stable/c/cb7b3633ed749db8e56f475f43c960652cbd6882"
        },
        {
          "url": "https://git.kernel.org/stable/c/8e2739478c164147d0774802008528d9e03fb802"
        },
        {
          "url": "https://git.kernel.org/stable/c/38c0ea484dedb58cb3a4391229933e16be0d1031"
        },
        {
          "url": "https://git.kernel.org/stable/c/7f8fdd4dbffc05982b96caf586f77a014b2a9353"
        }
      ],
      "title": "serial: 8250: fix panic due to PSLVERR",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-39724",
    "datePublished": "2025-09-05T17:21:32.005Z",
    "dateReserved": "2025-04-16T07:20:57.117Z",
    "dateUpdated": "2026-07-14T12:42:43.256Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-39756 (GCVE-0-2025-39756)

Vulnerability from cvelistv5 – Published: 2025-09-11 16:52 – Updated: 2026-09-08 08:42

Title

fs: Prevent file descriptor table allocations exceeding INT_MAX

Summary

In the Linux kernel, the following vulnerability has been resolved: fs: Prevent file descriptor table allocations exceeding INT_MAX When sysctl_nr_open is set to a very high value (for example, 1073741816 as set by systemd), processes attempting to use file descriptors near the limit can trigger massive memory allocation attempts that exceed INT_MAX, resulting in a WARNING in mm/slub.c: WARNING: CPU: 0 PID: 44 at mm/slub.c:5027 __kvmalloc_node_noprof+0x21a/0x288 This happens because kvmalloc_array() and kvmalloc() check if the requested size exceeds INT_MAX and emit a warning when the allocation is not flagged with __GFP_NOWARN. Specifically, when nr_open is set to 1073741816 (0x3ffffff8) and a process calls dup2(oldfd, 1073741880), the kernel attempts to allocate: - File descriptor array: 1073741880 * 8 bytes = 8,589,935,040 bytes - Multiple bitmaps: ~400MB - Total allocation size: > 8GB (exceeding INT_MAX = 2,147,483,647) Reproducer: 1. Set /proc/sys/fs/nr_open to 1073741816: # echo 1073741816 > /proc/sys/fs/nr_open 2. Run a program that uses a high file descriptor: #include <unistd.h> #include <sys/resource.h> int main() { struct rlimit rlim = {1073741824, 1073741824}; setrlimit(RLIMIT_NOFILE, &rlim); dup2(2, 1073741880); // Triggers the warning return 0; } 3. Observe WARNING in dmesg at mm/slub.c:5027 systemd commit a8b627a introduced automatic bumping of fs.nr_open to the maximum possible value. The rationale was that systems with memory control groups (memcg) no longer need separate file descriptor limits since memory is properly accounted. However, this change overlooked that: 1. The kernel's allocation functions still enforce INT_MAX as a maximum size regardless of memcg accounting 2. Programs and tests that legitimately test file descriptor limits can inadvertently trigger massive allocations 3. The resulting allocations (>8GB) are impractical and will always fail systemd's algorithm starts with INT_MAX and keeps halving the value until the kernel accepts it. On most systems, this results in nr_open being set to 1073741816 (0x3ffffff8), which is just under 1GB of file descriptors. While processes rarely use file descriptors near this limit in normal operation, certain selftests (like tools/testing/selftests/core/unshare_test.c) and programs that test file descriptor limits can trigger this issue. Fix this by adding a check in alloc_fdtable() to ensure the requested allocation size does not exceed INT_MAX. This causes the operation to fail with -EMFILE instead of triggering a kernel warning and avoids the impractical >8GB memory allocation request.

Severity

No CVSS data available.

Assigner

Linux mitre root

References

14 references

URL	Tags
https://git.kernel.org/stable/c/b4159c5a90c03f8ac…
https://git.kernel.org/stable/c/f95638a8f22eba307…
https://git.kernel.org/stable/c/749528086620f8012…
https://git.kernel.org/stable/c/628fc28f42d979f36…
https://git.kernel.org/stable/c/237e416eb62101f21…
https://git.kernel.org/stable/c/d4f9351243c17865a…
https://git.kernel.org/stable/c/9f61fa6a2a89a6101…
https://git.kernel.org/stable/c/dfd1f4ea98c3bd3a0…
https://git.kernel.org/stable/c/04a2c4b4511d186b0…
https://lists.debian.org/debian-lts-announce/2025…
https://lists.debian.org/debian-lts-announce/2025…
https://cert-portal.siemens.com/productcert/html/…
https://cert-portal.siemens.com/productcert/html/…
https://cert-portal.siemens.com/productcert/html/…

Impacted products

9 products

Vendor	Product	Version
Linux	Linux	Affected: 9cfe015aa424b3c003baba3841a60dd9b5ad319b , < b4159c5a90c03f8acd3de345a7f5fc63b0909818 (git) Affected: 9cfe015aa424b3c003baba3841a60dd9b5ad319b , < f95638a8f22eba307dceddf5aef9ae2326bbcf98 (git) Affected: 9cfe015aa424b3c003baba3841a60dd9b5ad319b , < 749528086620f8012b83ae032a80f6ffa80c45cd (git) Affected: 9cfe015aa424b3c003baba3841a60dd9b5ad319b , < 628fc28f42d979f36dbf75a6129ac7730e30c04e (git) Affected: 9cfe015aa424b3c003baba3841a60dd9b5ad319b , < 237e416eb62101f21b28c9e6e564d10efe1ecc6f (git) Affected: 9cfe015aa424b3c003baba3841a60dd9b5ad319b , < d4f9351243c17865a8cdbe6b3ccd09d0b13a7bcc (git) Affected: 9cfe015aa424b3c003baba3841a60dd9b5ad319b , < 9f61fa6a2a89a610120bc4e5d24379c667314b5c (git) Affected: 9cfe015aa424b3c003baba3841a60dd9b5ad319b , < dfd1f4ea98c3bd3a03d12169b5b2daa1f0a3e4ae (git) Affected: 9cfe015aa424b3c003baba3841a60dd9b5ad319b , < 04a2c4b4511d186b0fce685da21085a5d4acd370 (git)
Linux	Linux	Affected: 2.6.25 Unaffected: 0 , < 2.6.25 (semver) Unaffected: 5.4.297 , ≤ 5.4.* (semver) Unaffected: 5.10.241 , ≤ 5.10.* (semver) Unaffected: 5.15.190 , ≤ 5.15.* (semver) Unaffected: 6.1.149 , ≤ 6.1.* (semver) Unaffected: 6.6.103 , ≤ 6.6.* (semver) Unaffected: 6.12.43 , ≤ 6.12.* (semver) Unaffected: 6.15.11 , ≤ 6.15.* (semver) Unaffected: 6.16.2 , ≤ 6.16.* (semver) Unaffected: 6.17 , ≤ * (original_commit_for_fix)
Siemens	SIMATIC CN 4100	Affected: 0 , < V5.0 (custom)
Siemens	SIMATIC S7-1500 CPU 1518-4 PN/DP MFP	Affected: V3.1.5 , < * (custom)
Siemens	SIMATIC S7-1500 CPU 1518-4 PN/DP MFP	Affected: V3.1.6 , < * (custom)
Siemens	SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP	Affected: V3.1.5 , < * (custom)
Siemens	SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP	Affected: V3.1.6 , < * (custom)
Siemens	SIPLUS S7-1500 CPU 1518-4 PN/DP MFP	Affected: V3.1.5 , < * (custom)
Siemens	SIPLUS S7-1500 CPU 1518-4 PN/DP MFP	Affected: V3.1.6 , < * (custom)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T17:43:05.180Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html"
          },
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "affected": [
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC CN 4100",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V5.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.5",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.5",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.5",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.5",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.5",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-08T08:42:12.107Z",
          "orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
          "shortName": "siemens-SADP"
        },
        "references": [
          {
            "url": "https://cert-portal.siemens.com/productcert/html/ssa-082556.html"
          },
          {
            "url": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html"
          },
          {
            "url": "https://cert-portal.siemens.com/productcert/html/ssa-019113.html"
          }
        ],
        "x_adpType": "supplier"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/file.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "b4159c5a90c03f8acd3de345a7f5fc63b0909818",
              "status": "affected",
              "version": "9cfe015aa424b3c003baba3841a60dd9b5ad319b",
              "versionType": "git"
            },
            {
              "lessThan": "f95638a8f22eba307dceddf5aef9ae2326bbcf98",
              "status": "affected",
              "version": "9cfe015aa424b3c003baba3841a60dd9b5ad319b",
              "versionType": "git"
            },
            {
              "lessThan": "749528086620f8012b83ae032a80f6ffa80c45cd",
              "status": "affected",
              "version": "9cfe015aa424b3c003baba3841a60dd9b5ad319b",
              "versionType": "git"
            },
            {
              "lessThan": "628fc28f42d979f36dbf75a6129ac7730e30c04e",
              "status": "affected",
              "version": "9cfe015aa424b3c003baba3841a60dd9b5ad319b",
              "versionType": "git"
            },
            {
              "lessThan": "237e416eb62101f21b28c9e6e564d10efe1ecc6f",
              "status": "affected",
              "version": "9cfe015aa424b3c003baba3841a60dd9b5ad319b",
              "versionType": "git"
            },
            {
              "lessThan": "d4f9351243c17865a8cdbe6b3ccd09d0b13a7bcc",
              "status": "affected",
              "version": "9cfe015aa424b3c003baba3841a60dd9b5ad319b",
              "versionType": "git"
            },
            {
              "lessThan": "9f61fa6a2a89a610120bc4e5d24379c667314b5c",
              "status": "affected",
              "version": "9cfe015aa424b3c003baba3841a60dd9b5ad319b",
              "versionType": "git"
            },
            {
              "lessThan": "dfd1f4ea98c3bd3a03d12169b5b2daa1f0a3e4ae",
              "status": "affected",
              "version": "9cfe015aa424b3c003baba3841a60dd9b5ad319b",
              "versionType": "git"
            },
            {
              "lessThan": "04a2c4b4511d186b0fce685da21085a5d4acd370",
              "status": "affected",
              "version": "9cfe015aa424b3c003baba3841a60dd9b5ad319b",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/file.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.25"
            },
            {
              "lessThan": "2.6.25",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.297",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.241",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.190",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.149",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.103",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.43",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.15.*",
              "status": "unaffected",
              "version": "6.15.11",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.16.*",
              "status": "unaffected",
              "version": "6.16.2",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.17",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.297",
                  "versionStartIncluding": "2.6.25",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.241",
                  "versionStartIncluding": "2.6.25",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.190",
                  "versionStartIncluding": "2.6.25",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.149",
                  "versionStartIncluding": "2.6.25",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.103",
                  "versionStartIncluding": "2.6.25",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.43",
                  "versionStartIncluding": "2.6.25",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.15.11",
                  "versionStartIncluding": "2.6.25",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.16.2",
                  "versionStartIncluding": "2.6.25",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.17",
                  "versionStartIncluding": "2.6.25",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nfs: Prevent file descriptor table allocations exceeding INT_MAX\n\nWhen sysctl_nr_open is set to a very high value (for example, 1073741816\nas set by systemd), processes attempting to use file descriptors near\nthe limit can trigger massive memory allocation attempts that exceed\nINT_MAX, resulting in a WARNING in mm/slub.c:\n\n  WARNING: CPU: 0 PID: 44 at mm/slub.c:5027 __kvmalloc_node_noprof+0x21a/0x288\n\nThis happens because kvmalloc_array() and kvmalloc() check if the\nrequested size exceeds INT_MAX and emit a warning when the allocation is\nnot flagged with __GFP_NOWARN.\n\nSpecifically, when nr_open is set to 1073741816 (0x3ffffff8) and a\nprocess calls dup2(oldfd, 1073741880), the kernel attempts to allocate:\n- File descriptor array: 1073741880 * 8 bytes = 8,589,935,040 bytes\n- Multiple bitmaps: ~400MB\n- Total allocation size: \u003e 8GB (exceeding INT_MAX = 2,147,483,647)\n\nReproducer:\n1. Set /proc/sys/fs/nr_open to 1073741816:\n   # echo 1073741816 \u003e /proc/sys/fs/nr_open\n\n2. Run a program that uses a high file descriptor:\n   #include \u003cunistd.h\u003e\n   #include \u003csys/resource.h\u003e\n\n   int main() {\n       struct rlimit rlim = {1073741824, 1073741824};\n       setrlimit(RLIMIT_NOFILE, \u0026rlim);\n       dup2(2, 1073741880);  // Triggers the warning\n       return 0;\n   }\n\n3. Observe WARNING in dmesg at mm/slub.c:5027\n\nsystemd commit a8b627a introduced automatic bumping of fs.nr_open to the\nmaximum possible value. The rationale was that systems with memory\ncontrol groups (memcg) no longer need separate file descriptor limits\nsince memory is properly accounted. However, this change overlooked\nthat:\n\n1. The kernel\u0027s allocation functions still enforce INT_MAX as a maximum\n   size regardless of memcg accounting\n2. Programs and tests that legitimately test file descriptor limits can\n   inadvertently trigger massive allocations\n3. The resulting allocations (\u003e8GB) are impractical and will always fail\n\nsystemd\u0027s algorithm starts with INT_MAX and keeps halving the value\nuntil the kernel accepts it. On most systems, this results in nr_open\nbeing set to 1073741816 (0x3ffffff8), which is just under 1GB of file\ndescriptors.\n\nWhile processes rarely use file descriptors near this limit in normal\noperation, certain selftests (like\ntools/testing/selftests/core/unshare_test.c) and programs that test file\ndescriptor limits can trigger this issue.\n\nFix this by adding a check in alloc_fdtable() to ensure the requested\nallocation size does not exceed INT_MAX. This causes the operation to\nfail with -EMFILE instead of triggering a kernel warning and avoids the\nimpractical \u003e8GB memory allocation request."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T21:35:39.094Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/b4159c5a90c03f8acd3de345a7f5fc63b0909818"
        },
        {
          "url": "https://git.kernel.org/stable/c/f95638a8f22eba307dceddf5aef9ae2326bbcf98"
        },
        {
          "url": "https://git.kernel.org/stable/c/749528086620f8012b83ae032a80f6ffa80c45cd"
        },
        {
          "url": "https://git.kernel.org/stable/c/628fc28f42d979f36dbf75a6129ac7730e30c04e"
        },
        {
          "url": "https://git.kernel.org/stable/c/237e416eb62101f21b28c9e6e564d10efe1ecc6f"
        },
        {
          "url": "https://git.kernel.org/stable/c/d4f9351243c17865a8cdbe6b3ccd09d0b13a7bcc"
        },
        {
          "url": "https://git.kernel.org/stable/c/9f61fa6a2a89a610120bc4e5d24379c667314b5c"
        },
        {
          "url": "https://git.kernel.org/stable/c/dfd1f4ea98c3bd3a03d12169b5b2daa1f0a3e4ae"
        },
        {
          "url": "https://git.kernel.org/stable/c/04a2c4b4511d186b0fce685da21085a5d4acd370"
        }
      ],
      "title": "fs: Prevent file descriptor table allocations exceeding INT_MAX",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-39756",
    "datePublished": "2025-09-11T16:52:26.136Z",
    "dateReserved": "2025-04-16T07:20:57.125Z",
    "dateUpdated": "2026-09-08T08:42:12.107Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-39772 (GCVE-0-2025-39772)

Vulnerability from cvelistv5 – Published: 2025-09-11 16:56 – Updated: 2026-05-12 12:06

Title

drm/hisilicon/hibmc: fix the hibmc loaded failed bug

Summary

In the Linux kernel, the following vulnerability has been resolved: drm/hisilicon/hibmc: fix the hibmc loaded failed bug When hibmc loaded failed, the driver use hibmc_unload to free the resource, but the mutexes in mode.config are not init, which will access an NULL pointer. Just change goto statement to return, because hibnc_hw_init() doesn't need to free anything.

Severity

No CVSS data available.

Assigner

Linux mitre root

References

8 references

URL	Tags
https://git.kernel.org/stable/c/ddf1691f253456992…
https://git.kernel.org/stable/c/c950e1be3a24d0214…
https://git.kernel.org/stable/c/f93032e5d68f45960…
https://git.kernel.org/stable/c/a4f1b9c57092c48bd…
https://git.kernel.org/stable/c/d3e774266c28aefab…
https://git.kernel.org/stable/c/93a08f856fcc5aaee…
https://lists.debian.org/debian-lts-announce/2025…
https://cert-portal.siemens.com/productcert/html/…

Impacted products

3 products

Vendor	Product	Version
Linux	Linux	Affected: b3df5e65cc03696b0624a877d03a3ddf3ef43f52 , < ddf1691f25345699296e642f0f59f2d464722fa3 (git) Affected: b3df5e65cc03696b0624a877d03a3ddf3ef43f52 , < c950e1be3a24d021475b56efdb49daa7fbba63a9 (git) Affected: b3df5e65cc03696b0624a877d03a3ddf3ef43f52 , < f93032e5d68f459601c701f6ab087b5feb3382e8 (git) Affected: b3df5e65cc03696b0624a877d03a3ddf3ef43f52 , < a4f1b9c57092c48bdc7958abd23403ccaed437b2 (git) Affected: b3df5e65cc03696b0624a877d03a3ddf3ef43f52 , < d3e774266c28aefab3e9db334fdf568f936cae04 (git) Affected: b3df5e65cc03696b0624a877d03a3ddf3ef43f52 , < 93a08f856fcc5aaeeecad01f71bef3088588216a (git)
Linux	Linux	Affected: 4.14 Unaffected: 0 , < 4.14 (semver) Unaffected: 5.15.190 , ≤ 5.15.* (semver) Unaffected: 6.1.149 , ≤ 6.1.* (semver) Unaffected: 6.6.103 , ≤ 6.6.* (semver) Unaffected: 6.12.44 , ≤ 6.12.* (semver) Unaffected: 6.16.4 , ≤ 6.16.* (semver) Unaffected: 6.17 , ≤ * (original_commit_for_fix)
Siemens	SIMATIC CN 4100	Affected: 0 , < V5.0 (custom)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T17:43:13.756Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "affected": [
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC CN 4100",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V5.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-05-12T12:06:54.311Z",
          "orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
          "shortName": "siemens-SADP"
        },
        "references": [
          {
            "url": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html"
          }
        ],
        "x_adpType": "supplier"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_drv.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "ddf1691f25345699296e642f0f59f2d464722fa3",
              "status": "affected",
              "version": "b3df5e65cc03696b0624a877d03a3ddf3ef43f52",
              "versionType": "git"
            },
            {
              "lessThan": "c950e1be3a24d021475b56efdb49daa7fbba63a9",
              "status": "affected",
              "version": "b3df5e65cc03696b0624a877d03a3ddf3ef43f52",
              "versionType": "git"
            },
            {
              "lessThan": "f93032e5d68f459601c701f6ab087b5feb3382e8",
              "status": "affected",
              "version": "b3df5e65cc03696b0624a877d03a3ddf3ef43f52",
              "versionType": "git"
            },
            {
              "lessThan": "a4f1b9c57092c48bdc7958abd23403ccaed437b2",
              "status": "affected",
              "version": "b3df5e65cc03696b0624a877d03a3ddf3ef43f52",
              "versionType": "git"
            },
            {
              "lessThan": "d3e774266c28aefab3e9db334fdf568f936cae04",
              "status": "affected",
              "version": "b3df5e65cc03696b0624a877d03a3ddf3ef43f52",
              "versionType": "git"
            },
            {
              "lessThan": "93a08f856fcc5aaeeecad01f71bef3088588216a",
              "status": "affected",
              "version": "b3df5e65cc03696b0624a877d03a3ddf3ef43f52",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_drv.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.14"
            },
            {
              "lessThan": "4.14",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.190",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.149",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.103",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.44",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.16.*",
              "status": "unaffected",
              "version": "6.16.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.17",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.190",
                  "versionStartIncluding": "4.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.149",
                  "versionStartIncluding": "4.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.103",
                  "versionStartIncluding": "4.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.44",
                  "versionStartIncluding": "4.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.16.4",
                  "versionStartIncluding": "4.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.17",
                  "versionStartIncluding": "4.14",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/hisilicon/hibmc: fix the hibmc loaded failed bug\n\nWhen hibmc loaded failed, the driver use hibmc_unload to free the\nresource, but the mutexes in mode.config are not init, which will\naccess an NULL pointer. Just change goto statement to return, because\nhibnc_hw_init() doesn\u0027t need to free anything."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T21:35:57.826Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/ddf1691f25345699296e642f0f59f2d464722fa3"
        },
        {
          "url": "https://git.kernel.org/stable/c/c950e1be3a24d021475b56efdb49daa7fbba63a9"
        },
        {
          "url": "https://git.kernel.org/stable/c/f93032e5d68f459601c701f6ab087b5feb3382e8"
        },
        {
          "url": "https://git.kernel.org/stable/c/a4f1b9c57092c48bdc7958abd23403ccaed437b2"
        },
        {
          "url": "https://git.kernel.org/stable/c/d3e774266c28aefab3e9db334fdf568f936cae04"
        },
        {
          "url": "https://git.kernel.org/stable/c/93a08f856fcc5aaeeecad01f71bef3088588216a"
        }
      ],
      "title": "drm/hisilicon/hibmc: fix the hibmc loaded failed bug",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-39772",
    "datePublished": "2025-09-11T16:56:26.130Z",
    "dateReserved": "2025-04-16T07:20:57.128Z",
    "dateUpdated": "2026-05-12T12:06:54.311Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-39812 (GCVE-0-2025-39812)

Vulnerability from cvelistv5 – Published: 2025-09-16 13:00 – Updated: 2026-05-12 12:07

Title

sctp: initialize more fields in sctp_v6_from_sk()

Summary

In the Linux kernel, the following vulnerability has been resolved: sctp: initialize more fields in sctp_v6_from_sk() syzbot found that sin6_scope_id was not properly initialized, leading to undefined behavior. Clear sin6_scope_id and sin6_flowinfo. BUG: KMSAN: uninit-value in __sctp_v6_cmp_addr+0x887/0x8c0 net/sctp/ipv6.c:649 __sctp_v6_cmp_addr+0x887/0x8c0 net/sctp/ipv6.c:649 sctp_inet6_cmp_addr+0x4f2/0x510 net/sctp/ipv6.c:983 sctp_bind_addr_conflict+0x22a/0x3b0 net/sctp/bind_addr.c:390 sctp_get_port_local+0x21eb/0x2440 net/sctp/socket.c:8452 sctp_get_port net/sctp/socket.c:8523 [inline] sctp_listen_start net/sctp/socket.c:8567 [inline] sctp_inet_listen+0x710/0xfd0 net/sctp/socket.c:8636 __sys_listen_socket net/socket.c:1912 [inline] __sys_listen net/socket.c:1927 [inline] __do_sys_listen net/socket.c:1932 [inline] __se_sys_listen net/socket.c:1930 [inline] __x64_sys_listen+0x343/0x4c0 net/socket.c:1930 x64_sys_call+0x271d/0x3e20 arch/x86/include/generated/asm/syscalls_64.h:51 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xd9/0x210 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f Local variable addr.i.i created at: sctp_get_port net/sctp/socket.c:8515 [inline] sctp_listen_start net/sctp/socket.c:8567 [inline] sctp_inet_listen+0x650/0xfd0 net/sctp/socket.c:8636 __sys_listen_socket net/socket.c:1912 [inline] __sys_listen net/socket.c:1927 [inline] __do_sys_listen net/socket.c:1932 [inline] __se_sys_listen net/socket.c:1930 [inline] __x64_sys_listen+0x343/0x4c0 net/socket.c:1930

Severity

No CVSS data available.

Assigner

Linux mitre root

References

11 references

URL	Tags
https://git.kernel.org/stable/c/45e4b36593edffb7b…
https://git.kernel.org/stable/c/9546934c2054bba1b…
https://git.kernel.org/stable/c/17d6c7747045e9b80…
https://git.kernel.org/stable/c/65b4693d8bab5370c…
https://git.kernel.org/stable/c/463aa96fca6209bb2…
https://git.kernel.org/stable/c/1bbc0c02aea1f1c40…
https://git.kernel.org/stable/c/f6c2cc99fc2387ba6…
https://git.kernel.org/stable/c/2e8750469242cad8f…
https://lists.debian.org/debian-lts-announce/2025…
https://lists.debian.org/debian-lts-announce/2025…
https://cert-portal.siemens.com/productcert/html/…

Impacted products

3 products

Vendor	Product	Version
Linux	Linux	Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 45e4b36593edffb7bbee5828ae820bc10a9fa0f3 (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 9546934c2054bba1bd605c44e936619159a34027 (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 17d6c7747045e9b802c2f5dfaba260d309d831ae (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 65b4693d8bab5370cfcb44a275b4d8dcb06e56bf (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 463aa96fca6209bb205f49f7deea3817d7ddaa3a (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 1bbc0c02aea1f1c405bd1271466889c25a1fe01b (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < f6c2cc99fc2387ba6499facd6108f6543382792d (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 2e8750469242cad8f01f320131fd5a6f540dbb99 (git)
Linux	Linux	Affected: 2.6.12 Unaffected: 0 , < 2.6.12 (semver) Unaffected: 5.4.298 , ≤ 5.4.* (semver) Unaffected: 5.10.242 , ≤ 5.10.* (semver) Unaffected: 5.15.191 , ≤ 5.15.* (semver) Unaffected: 6.1.150 , ≤ 6.1.* (semver) Unaffected: 6.6.104 , ≤ 6.6.* (semver) Unaffected: 6.12.45 , ≤ 6.12.* (semver) Unaffected: 6.16.5 , ≤ 6.16.* (semver) Unaffected: 6.17 , ≤ * (original_commit_for_fix)
Siemens	SIMATIC CN 4100	Affected: 0 , < V5.0 (custom)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T17:43:36.526Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html"
          },
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "affected": [
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC CN 4100",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V5.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-05-12T12:07:13.590Z",
          "orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
          "shortName": "siemens-SADP"
        },
        "references": [
          {
            "url": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html"
          }
        ],
        "x_adpType": "supplier"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/sctp/ipv6.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "45e4b36593edffb7bbee5828ae820bc10a9fa0f3",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "9546934c2054bba1bd605c44e936619159a34027",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "17d6c7747045e9b802c2f5dfaba260d309d831ae",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "65b4693d8bab5370cfcb44a275b4d8dcb06e56bf",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "463aa96fca6209bb205f49f7deea3817d7ddaa3a",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "1bbc0c02aea1f1c405bd1271466889c25a1fe01b",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "f6c2cc99fc2387ba6499facd6108f6543382792d",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "2e8750469242cad8f01f320131fd5a6f540dbb99",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/sctp/ipv6.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.12"
            },
            {
              "lessThan": "2.6.12",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.298",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.242",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.191",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.150",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.104",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.45",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.16.*",
              "status": "unaffected",
              "version": "6.16.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.17",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.298",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.242",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.191",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.150",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.104",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.45",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.16.5",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.17",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsctp: initialize more fields in sctp_v6_from_sk()\n\nsyzbot found that sin6_scope_id was not properly initialized,\nleading to undefined behavior.\n\nClear sin6_scope_id and sin6_flowinfo.\n\nBUG: KMSAN: uninit-value in __sctp_v6_cmp_addr+0x887/0x8c0 net/sctp/ipv6.c:649\n  __sctp_v6_cmp_addr+0x887/0x8c0 net/sctp/ipv6.c:649\n  sctp_inet6_cmp_addr+0x4f2/0x510 net/sctp/ipv6.c:983\n  sctp_bind_addr_conflict+0x22a/0x3b0 net/sctp/bind_addr.c:390\n  sctp_get_port_local+0x21eb/0x2440 net/sctp/socket.c:8452\n  sctp_get_port net/sctp/socket.c:8523 [inline]\n  sctp_listen_start net/sctp/socket.c:8567 [inline]\n  sctp_inet_listen+0x710/0xfd0 net/sctp/socket.c:8636\n  __sys_listen_socket net/socket.c:1912 [inline]\n  __sys_listen net/socket.c:1927 [inline]\n  __do_sys_listen net/socket.c:1932 [inline]\n  __se_sys_listen net/socket.c:1930 [inline]\n  __x64_sys_listen+0x343/0x4c0 net/socket.c:1930\n  x64_sys_call+0x271d/0x3e20 arch/x86/include/generated/asm/syscalls_64.h:51\n  do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]\n  do_syscall_64+0xd9/0x210 arch/x86/entry/syscall_64.c:94\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n\nLocal variable addr.i.i created at:\n  sctp_get_port net/sctp/socket.c:8515 [inline]\n  sctp_listen_start net/sctp/socket.c:8567 [inline]\n  sctp_inet_listen+0x650/0xfd0 net/sctp/socket.c:8636\n  __sys_listen_socket net/socket.c:1912 [inline]\n  __sys_listen net/socket.c:1927 [inline]\n  __do_sys_listen net/socket.c:1932 [inline]\n  __se_sys_listen net/socket.c:1930 [inline]\n  __x64_sys_listen+0x343/0x4c0 net/socket.c:1930"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T21:36:49.762Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/45e4b36593edffb7bbee5828ae820bc10a9fa0f3"
        },
        {
          "url": "https://git.kernel.org/stable/c/9546934c2054bba1bd605c44e936619159a34027"
        },
        {
          "url": "https://git.kernel.org/stable/c/17d6c7747045e9b802c2f5dfaba260d309d831ae"
        },
        {
          "url": "https://git.kernel.org/stable/c/65b4693d8bab5370cfcb44a275b4d8dcb06e56bf"
        },
        {
          "url": "https://git.kernel.org/stable/c/463aa96fca6209bb205f49f7deea3817d7ddaa3a"
        },
        {
          "url": "https://git.kernel.org/stable/c/1bbc0c02aea1f1c405bd1271466889c25a1fe01b"
        },
        {
          "url": "https://git.kernel.org/stable/c/f6c2cc99fc2387ba6499facd6108f6543382792d"
        },
        {
          "url": "https://git.kernel.org/stable/c/2e8750469242cad8f01f320131fd5a6f540dbb99"
        }
      ],
      "title": "sctp: initialize more fields in sctp_v6_from_sk()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-39812",
    "datePublished": "2025-09-16T13:00:14.103Z",
    "dateReserved": "2025-04-16T07:20:57.137Z",
    "dateUpdated": "2026-05-12T12:07:13.590Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-39813 (GCVE-0-2025-39813)

Vulnerability from cvelistv5 – Published: 2025-09-16 13:00 – Updated: 2026-05-12 12:07

Title

ftrace: Fix potential warning in trace_printk_seq during ftrace_dump

Summary

In the Linux kernel, the following vulnerability has been resolved: ftrace: Fix potential warning in trace_printk_seq during ftrace_dump When calling ftrace_dump_one() concurrently with reading trace_pipe, a WARN_ON_ONCE() in trace_printk_seq() can be triggered due to a race condition. The issue occurs because: CPU0 (ftrace_dump) CPU1 (reader) echo z > /proc/sysrq-trigger !trace_empty(&iter) trace_iterator_reset(&iter) <- len = size = 0 cat /sys/kernel/tracing/trace_pipe trace_find_next_entry_inc(&iter) __find_next_entry ring_buffer_empty_cpu <- all empty return NULL trace_printk_seq(&iter.seq) WARN_ON_ONCE(s->seq.len >= s->seq.size) In the context between trace_empty() and trace_find_next_entry_inc() during ftrace_dump, the ring buffer data was consumed by other readers. This caused trace_find_next_entry_inc to return NULL, failing to populate `iter.seq`. At this point, due to the prior trace_iterator_reset, both `iter.seq.len` and `iter.seq.size` were set to 0. Since they are equal, the WARN_ON_ONCE condition is triggered. Move the trace_printk_seq() into the if block that checks to make sure the return value of trace_find_next_entry_inc() is non-NULL in ftrace_dump_one(), ensuring the 'iter.seq' is properly populated before subsequent operations.

Severity

No CVSS data available.

Assigner

Linux mitre root

References

11 references

URL	Tags
https://git.kernel.org/stable/c/f299353e7ccbcc5c2…
https://git.kernel.org/stable/c/5ab0ec206deb99eb3…
https://git.kernel.org/stable/c/a6f0f8873cc30fd45…
https://git.kernel.org/stable/c/e80ff23ba8bdb0f41…
https://git.kernel.org/stable/c/28c8fb7ae2ad27d81…
https://git.kernel.org/stable/c/ced94e137e6cd5e79…
https://git.kernel.org/stable/c/fbd4cf7ee4db65ef3…
https://git.kernel.org/stable/c/4013aef2ced9b756a…
https://lists.debian.org/debian-lts-announce/2025…
https://lists.debian.org/debian-lts-announce/2025…
https://cert-portal.siemens.com/productcert/html/…

Impacted products

3 products

Vendor	Product	Version
Linux	Linux	Affected: d769041f865330034131525ee6a7f72eb4af2a24 , < f299353e7ccbcc5c2ed8993c48fbe7609cbe729a (git) Affected: d769041f865330034131525ee6a7f72eb4af2a24 , < 5ab0ec206deb99eb3baf8f1d7602aeaa91dbcc85 (git) Affected: d769041f865330034131525ee6a7f72eb4af2a24 , < a6f0f8873cc30fd4543b09adf03f7f51d293f0e6 (git) Affected: d769041f865330034131525ee6a7f72eb4af2a24 , < e80ff23ba8bdb0f41a1afe2657078e4097d13a9a (git) Affected: d769041f865330034131525ee6a7f72eb4af2a24 , < 28c8fb7ae2ad27d81c8de3c4fe608c509f6a18aa (git) Affected: d769041f865330034131525ee6a7f72eb4af2a24 , < ced94e137e6cd5e79c65564841d3b7695d0f5fa3 (git) Affected: d769041f865330034131525ee6a7f72eb4af2a24 , < fbd4cf7ee4db65ef36796769fe978e9eba6f0de4 (git) Affected: d769041f865330034131525ee6a7f72eb4af2a24 , < 4013aef2ced9b756a410f50d12df9ebe6a883e4a (git)
Linux	Linux	Affected: 2.6.28 Unaffected: 0 , < 2.6.28 (semver) Unaffected: 5.4.298 , ≤ 5.4.* (semver) Unaffected: 5.10.242 , ≤ 5.10.* (semver) Unaffected: 5.15.191 , ≤ 5.15.* (semver) Unaffected: 6.1.150 , ≤ 6.1.* (semver) Unaffected: 6.6.104 , ≤ 6.6.* (semver) Unaffected: 6.12.45 , ≤ 6.12.* (semver) Unaffected: 6.16.5 , ≤ 6.16.* (semver) Unaffected: 6.17 , ≤ * (original_commit_for_fix)
Siemens	SIMATIC CN 4100	Affected: 0 , < V5.0 (custom)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T17:43:38.484Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html"
          },
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "affected": [
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC CN 4100",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V5.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-05-12T12:07:14.764Z",
          "orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
          "shortName": "siemens-SADP"
        },
        "references": [
          {
            "url": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html"
          }
        ],
        "x_adpType": "supplier"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "kernel/trace/trace.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "f299353e7ccbcc5c2ed8993c48fbe7609cbe729a",
              "status": "affected",
              "version": "d769041f865330034131525ee6a7f72eb4af2a24",
              "versionType": "git"
            },
            {
              "lessThan": "5ab0ec206deb99eb3baf8f1d7602aeaa91dbcc85",
              "status": "affected",
              "version": "d769041f865330034131525ee6a7f72eb4af2a24",
              "versionType": "git"
            },
            {
              "lessThan": "a6f0f8873cc30fd4543b09adf03f7f51d293f0e6",
              "status": "affected",
              "version": "d769041f865330034131525ee6a7f72eb4af2a24",
              "versionType": "git"
            },
            {
              "lessThan": "e80ff23ba8bdb0f41a1afe2657078e4097d13a9a",
              "status": "affected",
              "version": "d769041f865330034131525ee6a7f72eb4af2a24",
              "versionType": "git"
            },
            {
              "lessThan": "28c8fb7ae2ad27d81c8de3c4fe608c509f6a18aa",
              "status": "affected",
              "version": "d769041f865330034131525ee6a7f72eb4af2a24",
              "versionType": "git"
            },
            {
              "lessThan": "ced94e137e6cd5e79c65564841d3b7695d0f5fa3",
              "status": "affected",
              "version": "d769041f865330034131525ee6a7f72eb4af2a24",
              "versionType": "git"
            },
            {
              "lessThan": "fbd4cf7ee4db65ef36796769fe978e9eba6f0de4",
              "status": "affected",
              "version": "d769041f865330034131525ee6a7f72eb4af2a24",
              "versionType": "git"
            },
            {
              "lessThan": "4013aef2ced9b756a410f50d12df9ebe6a883e4a",
              "status": "affected",
              "version": "d769041f865330034131525ee6a7f72eb4af2a24",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "kernel/trace/trace.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.28"
            },
            {
              "lessThan": "2.6.28",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.298",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.242",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.191",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.150",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.104",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.45",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.16.*",
              "status": "unaffected",
              "version": "6.16.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.17",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.298",
                  "versionStartIncluding": "2.6.28",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.242",
                  "versionStartIncluding": "2.6.28",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.191",
                  "versionStartIncluding": "2.6.28",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.150",
                  "versionStartIncluding": "2.6.28",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.104",
                  "versionStartIncluding": "2.6.28",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.45",
                  "versionStartIncluding": "2.6.28",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.16.5",
                  "versionStartIncluding": "2.6.28",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.17",
                  "versionStartIncluding": "2.6.28",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nftrace: Fix potential warning in trace_printk_seq during ftrace_dump\n\nWhen calling ftrace_dump_one() concurrently with reading trace_pipe,\na WARN_ON_ONCE() in trace_printk_seq() can be triggered due to a race\ncondition.\n\nThe issue occurs because:\n\nCPU0 (ftrace_dump)                              CPU1 (reader)\necho z \u003e /proc/sysrq-trigger\n\n!trace_empty(\u0026iter)\ntrace_iterator_reset(\u0026iter) \u003c- len = size = 0\n                                                cat /sys/kernel/tracing/trace_pipe\ntrace_find_next_entry_inc(\u0026iter)\n  __find_next_entry\n    ring_buffer_empty_cpu \u003c- all empty\n  return NULL\n\ntrace_printk_seq(\u0026iter.seq)\n  WARN_ON_ONCE(s-\u003eseq.len \u003e= s-\u003eseq.size)\n\nIn the context between trace_empty() and trace_find_next_entry_inc()\nduring ftrace_dump, the ring buffer data was consumed by other readers.\nThis caused trace_find_next_entry_inc to return NULL, failing to populate\n`iter.seq`. At this point, due to the prior trace_iterator_reset, both\n`iter.seq.len` and `iter.seq.size` were set to 0. Since they are equal,\nthe WARN_ON_ONCE condition is triggered.\n\nMove the trace_printk_seq() into the if block that checks to make sure the\nreturn value of trace_find_next_entry_inc() is non-NULL in\nftrace_dump_one(), ensuring the \u0027iter.seq\u0027 is properly populated before\nsubsequent operations."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T21:36:50.968Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/f299353e7ccbcc5c2ed8993c48fbe7609cbe729a"
        },
        {
          "url": "https://git.kernel.org/stable/c/5ab0ec206deb99eb3baf8f1d7602aeaa91dbcc85"
        },
        {
          "url": "https://git.kernel.org/stable/c/a6f0f8873cc30fd4543b09adf03f7f51d293f0e6"
        },
        {
          "url": "https://git.kernel.org/stable/c/e80ff23ba8bdb0f41a1afe2657078e4097d13a9a"
        },
        {
          "url": "https://git.kernel.org/stable/c/28c8fb7ae2ad27d81c8de3c4fe608c509f6a18aa"
        },
        {
          "url": "https://git.kernel.org/stable/c/ced94e137e6cd5e79c65564841d3b7695d0f5fa3"
        },
        {
          "url": "https://git.kernel.org/stable/c/fbd4cf7ee4db65ef36796769fe978e9eba6f0de4"
        },
        {
          "url": "https://git.kernel.org/stable/c/4013aef2ced9b756a410f50d12df9ebe6a883e4a"
        }
      ],
      "title": "ftrace: Fix potential warning in trace_printk_seq during ftrace_dump",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-39813",
    "datePublished": "2025-09-16T13:00:14.846Z",
    "dateReserved": "2025-04-16T07:20:57.137Z",
    "dateUpdated": "2026-05-12T12:07:14.764Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-39841 (GCVE-0-2025-39841)

Vulnerability from cvelistv5 – Published: 2025-09-19 15:26 – Updated: 2026-08-05 12:05

Title

scsi: lpfc: Fix buffer free/clear order in deferred receive path

Summary

In the Linux kernel, the following vulnerability has been resolved: scsi: lpfc: Fix buffer free/clear order in deferred receive path Fix a use-after-free window by correcting the buffer release sequence in the deferred receive path. The code freed the RQ buffer first and only then cleared the context pointer under the lock. Concurrent paths (e.g., ABTS and the repost path) also inspect and release the same pointer under the lock, so the old order could lead to double-free/UAF. Note that the repost path already uses the correct pattern: detach the pointer under the lock, then free it after dropping the lock. The deferred path should do the same.

Severity

9.8 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-06-10 20:42 UTC

Assigner

Linux mitre root

References

12 references

URL	Tags
https://git.kernel.org/stable/c/ab34084f42ee06a90…
https://git.kernel.org/stable/c/baa39f6ad79d372a6…
https://git.kernel.org/stable/c/95b63d15fce5c54a7…
https://git.kernel.org/stable/c/55658c7501467ca9e…
https://git.kernel.org/stable/c/d96cc9a1b57725930…
https://git.kernel.org/stable/c/367cb5ffd8a8a4c85…
https://git.kernel.org/stable/c/897f64b01c1249ac7…
https://git.kernel.org/stable/c/9dba9a45c348e8460…
https://lists.debian.org/debian-lts-announce/2025…
https://lists.debian.org/debian-lts-announce/2025…
https://cert-portal.siemens.com/productcert/html/…
https://cert-portal.siemens.com/productcert/html/…

Impacted products

19 products

Vendor	Product	Version
Linux	Linux	Affected: 472e146d1cf3410a898b49834500fa9e33ac41a2 , < ab34084f42ee06a9028d67c78feafb911d33d111 (git) Affected: 472e146d1cf3410a898b49834500fa9e33ac41a2 , < baa39f6ad79d372a6ce0aa639fbb2f1578479f57 (git) Affected: 472e146d1cf3410a898b49834500fa9e33ac41a2 , < 95b63d15fce5c54a73bbf195e1aacb5a75b128e2 (git) Affected: 472e146d1cf3410a898b49834500fa9e33ac41a2 , < 55658c7501467ca9ef3bd4453dd920010db8bc13 (git) Affected: 472e146d1cf3410a898b49834500fa9e33ac41a2 , < d96cc9a1b57725930c60b607423759d563b4d900 (git) Affected: 472e146d1cf3410a898b49834500fa9e33ac41a2 , < 367cb5ffd8a8a4c85dc89f55e7fa7cc191425b11 (git) Affected: 472e146d1cf3410a898b49834500fa9e33ac41a2 , < 897f64b01c1249ac730329b83f4f40bab71e86c7 (git) Affected: 472e146d1cf3410a898b49834500fa9e33ac41a2 , < 9dba9a45c348e8460da97c450cddf70b2056deb3 (git)
Linux	Linux	Affected: 5.1 Unaffected: 0 , < 5.1 (semver) Unaffected: 5.4.299 , ≤ 5.4.* (semver) Unaffected: 5.10.243 , ≤ 5.10.* (semver) Unaffected: 5.15.192 , ≤ 5.15.* (semver) Unaffected: 6.1.151 , ≤ 6.1.* (semver) Unaffected: 6.6.105 , ≤ 6.6.* (semver) Unaffected: 6.12.46 , ≤ 6.12.* (semver) Unaffected: 6.16.6 , ≤ 6.16.* (semver) Unaffected: 6.17 , ≤ * (original_commit_for_fix)
Siemens	RUGGEDCOM RST2428P	Affected: 0 , < V3.3 (custom)
Siemens	SCALANCE XC-300/XR-300/XC-400/XR-500WG/XR-500 family	Affected: 0 , < V3.3 (custom)
Siemens	SCALANCE XCH328	Affected: 0 , < V3.3 (custom)
Siemens	SCALANCE XCM324	Affected: 0 , < V3.3 (custom)
Siemens	SCALANCE XCM328	Affected: 0 , < V3.3 (custom)
Siemens	SCALANCE XCM332	Affected: 0 , < V3.3 (custom)
Siemens	SCALANCE XRH334 (24 V DC, 8xFO, CC)	Affected: 0 , < V3.3 (custom)
Siemens	SCALANCE XRM334 (230 V AC, 12xFO)	Affected: 0 , < V3.3 (custom)
Siemens	SCALANCE XRM334 (230 V AC, 8xFO)	Affected: 0 , < V3.3 (custom)
Siemens	SCALANCE XRM334 (230V AC, 2x10G, 24xSFP, 8xSFP+)	Affected: 0 , < V3.3 (custom)
Siemens	SCALANCE XRM334 (24 V DC, 12xFO)	Affected: 0 , < V3.3 (custom)
Siemens	SCALANCE XRM334 (24 V DC, 8xFO)	Affected: 0 , < V3.3 (custom)
Siemens	SCALANCE XRM334 (24V DC, 2x10G, 24xSFP, 8xSFP+)	Affected: 0 , < V3.3 (custom)
Siemens	SCALANCE XRM334 (2x230 V AC, 12xFO)	Affected: 0 , < V3.3 (custom)
Siemens	SCALANCE XRM334 (2x230 V AC, 8xFO)	Affected: 0 , < V3.3 (custom)
Siemens	SCALANCE XRM334 (2x230V AC, 2x10G, 24xSFP, 8xSFP+)	Affected: 0 , < V3.3 (custom)
Siemens	SIMATIC CN 4100	Affected: 0 , < V5.0 (custom)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T17:43:56.756Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html"
          },
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "affected": [
          {
            "defaultStatus": "unknown",
            "product": "RUGGEDCOM RST2428P",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V3.3",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE XC-300/XR-300/XC-400/XR-500WG/XR-500 family",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V3.3",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE XCH328",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V3.3",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE XCM324",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V3.3",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE XCM328",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V3.3",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE XCM332",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V3.3",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE XRH334 (24 V DC, 8xFO, CC)",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V3.3",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE XRM334 (230 V AC, 12xFO)",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V3.3",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE XRM334 (230 V AC, 8xFO)",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V3.3",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE XRM334 (230V AC, 2x10G, 24xSFP, 8xSFP+)",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V3.3",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE XRM334 (24 V DC, 12xFO)",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V3.3",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE XRM334 (24 V DC, 8xFO)",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V3.3",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE XRM334 (24V DC, 2x10G, 24xSFP, 8xSFP+)",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V3.3",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE XRM334 (2x230 V AC, 12xFO)",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V3.3",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE XRM334 (2x230 V AC, 8xFO)",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V3.3",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE XRM334 (2x230V AC, 2x10G, 24xSFP, 8xSFP+)",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V3.3",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC CN 4100",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V5.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-05-12T12:07:28.917Z",
          "orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
          "shortName": "siemens-SADP"
        },
        "references": [
          {
            "url": "https://cert-portal.siemens.com/productcert/html/ssa-089022.html"
          },
          {
            "url": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html"
          }
        ],
        "x_adpType": "supplier"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-39841",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-10T20:42:00.721283Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-11T18:44:18.587Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/scsi/lpfc/lpfc_nvmet.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "ab34084f42ee06a9028d67c78feafb911d33d111",
              "status": "affected",
              "version": "472e146d1cf3410a898b49834500fa9e33ac41a2",
              "versionType": "git"
            },
            {
              "lessThan": "baa39f6ad79d372a6ce0aa639fbb2f1578479f57",
              "status": "affected",
              "version": "472e146d1cf3410a898b49834500fa9e33ac41a2",
              "versionType": "git"
            },
            {
              "lessThan": "95b63d15fce5c54a73bbf195e1aacb5a75b128e2",
              "status": "affected",
              "version": "472e146d1cf3410a898b49834500fa9e33ac41a2",
              "versionType": "git"
            },
            {
              "lessThan": "55658c7501467ca9ef3bd4453dd920010db8bc13",
              "status": "affected",
              "version": "472e146d1cf3410a898b49834500fa9e33ac41a2",
              "versionType": "git"
            },
            {
              "lessThan": "d96cc9a1b57725930c60b607423759d563b4d900",
              "status": "affected",
              "version": "472e146d1cf3410a898b49834500fa9e33ac41a2",
              "versionType": "git"
            },
            {
              "lessThan": "367cb5ffd8a8a4c85dc89f55e7fa7cc191425b11",
              "status": "affected",
              "version": "472e146d1cf3410a898b49834500fa9e33ac41a2",
              "versionType": "git"
            },
            {
              "lessThan": "897f64b01c1249ac730329b83f4f40bab71e86c7",
              "status": "affected",
              "version": "472e146d1cf3410a898b49834500fa9e33ac41a2",
              "versionType": "git"
            },
            {
              "lessThan": "9dba9a45c348e8460da97c450cddf70b2056deb3",
              "status": "affected",
              "version": "472e146d1cf3410a898b49834500fa9e33ac41a2",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/scsi/lpfc/lpfc_nvmet.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.1"
            },
            {
              "lessThan": "5.1",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.299",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.243",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.192",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.151",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.105",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.46",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.16.*",
              "status": "unaffected",
              "version": "6.16.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.17",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.299",
                  "versionStartIncluding": "5.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.243",
                  "versionStartIncluding": "5.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.192",
                  "versionStartIncluding": "5.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.151",
                  "versionStartIncluding": "5.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.105",
                  "versionStartIncluding": "5.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.46",
                  "versionStartIncluding": "5.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.16.6",
                  "versionStartIncluding": "5.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.17",
                  "versionStartIncluding": "5.1",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: lpfc: Fix buffer free/clear order in deferred receive path\n\nFix a use-after-free window by correcting the buffer release sequence in\nthe deferred receive path. The code freed the RQ buffer first and only\nthen cleared the context pointer under the lock. Concurrent paths (e.g.,\nABTS and the repost path) also inspect and release the same pointer under\nthe lock, so the old order could lead to double-free/UAF.\n\nNote that the repost path already uses the correct pattern: detach the\npointer under the lock, then free it after dropping the lock. The\ndeferred path should do the same."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The vulnerable code is the lpfc NVMe-over-Fibre-Channel target\u0027s receive path, processing FCP command and ABTS frames sent by a remote NVMe-oF initiator peer, directly analogous to nvmet-tcp; FC fabrics are also routable across sites via FCIP/inter-fabric routing and FCoE. Repo precedent (CVE-2026-43414, qla2xxx FC) scores FC-peer-triggered driver memory corruption as Network.\nAC:L - The remote initiator controls both sides of the race \u2014 it forces the deferred path by flooding the queue past its fod count (-EOVERFLOW) and drives lpfc_nvmet_ctxbuf_post() concurrently by sending ABTS for the same exchange \u2014 and can retry at FC line rate until the unlocked free/clear window is hit.\nPR:N - NVMe/FC provides no transport authentication and no TLS; hostnqn-based allow-lists are an authorization filter that a fabric-attached attacker can spoof, and ABTS frames reaching lpfc_nvmet_rcv_unsol_abort() require no established association at all. No privileges on the target host are needed.\nUI:N - The race is triggered entirely by inbound FC frames processed asynchronously in the driver\u0027s interrupt/completion and workqueue contexts. No administrator or user action on the target system is required.\nS:U - The double-free and use-after-free corrupt kernel heap and DMA-pool state within the target host\u0027s own kernel security authority. No VM, IOMMU, or sandbox boundary is crossed.\nC:H - The freed rqb_dmabuf is re-read after kfree() (rqb_entry-\u003ehrq-\u003erqbp, hbuf.phys/dbuf.phys), and the double dma_pool_free() lets the same DMA buffer be handed to two live exchanges, so one initiator\u0027s data lands in another\u0027s buffer. Heap grooming around the freed slab object yields an arbitrary-read primitive.\nI:H - lpfc_rq_buf_free() performs a list_del() write into the freed object and re-posts stale DMA addresses to the hardware RQ, causing the HBA to DMA attacker-supplied FC frame content into freed/reallocated kernel memory \u2014 a remote, attacker-controlled kernel write primitive, plus double-free-based heap control.\nA:H - The double kfree()/dma_pool_free() and freed-list corruption reliably produce slab corruption, BUG_ON in the allocator, or an oops in the interrupt-context completion handler, panicking the storage target host."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:05:34.724Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/ab34084f42ee06a9028d67c78feafb911d33d111"
        },
        {
          "url": "https://git.kernel.org/stable/c/baa39f6ad79d372a6ce0aa639fbb2f1578479f57"
        },
        {
          "url": "https://git.kernel.org/stable/c/95b63d15fce5c54a73bbf195e1aacb5a75b128e2"
        },
        {
          "url": "https://git.kernel.org/stable/c/55658c7501467ca9ef3bd4453dd920010db8bc13"
        },
        {
          "url": "https://git.kernel.org/stable/c/d96cc9a1b57725930c60b607423759d563b4d900"
        },
        {
          "url": "https://git.kernel.org/stable/c/367cb5ffd8a8a4c85dc89f55e7fa7cc191425b11"
        },
        {
          "url": "https://git.kernel.org/stable/c/897f64b01c1249ac730329b83f4f40bab71e86c7"
        },
        {
          "url": "https://git.kernel.org/stable/c/9dba9a45c348e8460da97c450cddf70b2056deb3"
        }
      ],
      "title": "scsi: lpfc: Fix buffer free/clear order in deferred receive path",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-39841",
    "datePublished": "2025-09-19T15:26:16.349Z",
    "dateReserved": "2025-04-16T07:20:57.141Z",
    "dateUpdated": "2026-08-05T12:05:34.724Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-39866 (GCVE-0-2025-39866)

Vulnerability from cvelistv5 – Published: 2025-09-19 15:26 – Updated: 2026-09-08 08:42

Title

fs: writeback: fix use-after-free in __mark_inode_dirty()

Summary

In the Linux kernel, the following vulnerability has been resolved: fs: writeback: fix use-after-free in __mark_inode_dirty() An use-after-free issue occurred when __mark_inode_dirty() get the bdi_writeback that was in the progress of switching. CPU: 1 PID: 562 Comm: systemd-random- Not tainted 6.6.56-gb4403bd46a8e #1 ...... pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : __mark_inode_dirty+0x124/0x418 lr : __mark_inode_dirty+0x118/0x418 sp : ffffffc08c9dbbc0 ........ Call trace: __mark_inode_dirty+0x124/0x418 generic_update_time+0x4c/0x60 file_modified+0xcc/0xd0 ext4_buffered_write_iter+0x58/0x124 ext4_file_write_iter+0x54/0x704 vfs_write+0x1c0/0x308 ksys_write+0x74/0x10c __arm64_sys_write+0x1c/0x28 invoke_syscall+0x48/0x114 el0_svc_common.constprop.0+0xc0/0xe0 do_el0_svc+0x1c/0x28 el0_svc+0x40/0xe4 el0t_64_sync_handler+0x120/0x12c el0t_64_sync+0x194/0x198 Root cause is: systemd-random-seed kworker ---------------------------------------------------------------------- ___mark_inode_dirty inode_switch_wbs_work_fn spin_lock(&inode->i_lock); inode_attach_wb locked_inode_to_wb_and_lock_list get inode->i_wb spin_unlock(&inode->i_lock); spin_lock(&wb->list_lock) spin_lock(&inode->i_lock) inode_io_list_move_locked spin_unlock(&wb->list_lock) spin_unlock(&inode->i_lock) spin_lock(&old_wb->list_lock) inode_do_switch_wbs spin_lock(&inode->i_lock) inode->i_wb = new_wb spin_unlock(&inode->i_lock) spin_unlock(&old_wb->list_lock) wb_put_many(old_wb, nr_switched) cgwb_release old wb released wb_wakeup_delayed() accesses wb, then trigger the use-after-free issue Fix this race condition by holding inode spinlock until wb_wakeup_delayed() finished.

Severity

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Assigner

Linux mitre root

References

11 references

URL	Tags
https://git.kernel.org/stable/c/e2a14bbae5d8bacaa…
https://git.kernel.org/stable/c/b187c976111960e6e…
https://git.kernel.org/stable/c/1edc2feb9c759a988…
https://git.kernel.org/stable/c/bf89b1f87c72df79c…
https://git.kernel.org/stable/c/e63052921f1b25a83…
https://git.kernel.org/stable/c/c8c14adf80bd1a6e4…
https://git.kernel.org/stable/c/d02d2c98d25793902…
https://lists.debian.org/debian-lts-announce/2025…
https://cert-portal.siemens.com/productcert/html/…
https://cert-portal.siemens.com/productcert/html/…
https://cert-portal.siemens.com/productcert/html/…

Impacted products

9 products

Vendor	Product	Version
Linux	Linux	Affected: 0747259d13febfcc838980a63c414c9b920cea6f , < e2a14bbae5d8bacaa301362744a110e2be40a3a3 (git) Affected: 0747259d13febfcc838980a63c414c9b920cea6f , < b187c976111960e6e54a6b1fff724f6e3d39406c (git) Affected: 0747259d13febfcc838980a63c414c9b920cea6f , < 1edc2feb9c759a9883dfe81cb5ed231412d8b2e4 (git) Affected: 0747259d13febfcc838980a63c414c9b920cea6f , < bf89b1f87c72df79cf76203f71fbf8349cd5c9de (git) Affected: 0747259d13febfcc838980a63c414c9b920cea6f , < e63052921f1b25a836feb1500b841bff7a4a0456 (git) Affected: 0747259d13febfcc838980a63c414c9b920cea6f , < c8c14adf80bd1a6e4a1d7ee9c2a816881c26d17a (git) Affected: 0747259d13febfcc838980a63c414c9b920cea6f , < d02d2c98d25793902f65803ab853b592c7a96b29 (git)
Linux	Linux	Affected: 4.2 Unaffected: 0 , < 4.2 (semver) Unaffected: 5.10.247 , ≤ 5.10.* (semver) Unaffected: 5.15.192 , ≤ 5.15.* (semver) Unaffected: 6.1.151 , ≤ 6.1.* (semver) Unaffected: 6.6.105 , ≤ 6.6.* (semver) Unaffected: 6.12.46 , ≤ 6.12.* (semver) Unaffected: 6.16.6 , ≤ 6.16.* (semver) Unaffected: 6.17 , ≤ * (original_commit_for_fix)
Siemens	SIMATIC CN 4100	Affected: 0 , < V5.0 (custom)
Siemens	SIMATIC S7-1500 CPU 1518-4 PN/DP MFP	Affected: V3.1.5 , < * (custom)
Siemens	SIMATIC S7-1500 CPU 1518-4 PN/DP MFP	Affected: V3.1.6 , < * (custom)
Siemens	SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP	Affected: V3.1.5 , < * (custom)
Siemens	SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP	Affected: V3.1.6 , < * (custom)
Siemens	SIPLUS S7-1500 CPU 1518-4 PN/DP MFP	Affected: V3.1.5 , < * (custom)
Siemens	SIPLUS S7-1500 CPU 1518-4 PN/DP MFP	Affected: V3.1.6 , < * (custom)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T17:44:17.299Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "affected": [
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC CN 4100",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V5.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.5",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.5",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.5",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.5",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.5",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-08T08:42:30.193Z",
          "orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
          "shortName": "siemens-SADP"
        },
        "references": [
          {
            "url": "https://cert-portal.siemens.com/productcert/html/ssa-082556.html"
          },
          {
            "url": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html"
          },
          {
            "url": "https://cert-portal.siemens.com/productcert/html/ssa-019113.html"
          }
        ],
        "x_adpType": "supplier"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/fs-writeback.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "e2a14bbae5d8bacaa301362744a110e2be40a3a3",
              "status": "affected",
              "version": "0747259d13febfcc838980a63c414c9b920cea6f",
              "versionType": "git"
            },
            {
              "lessThan": "b187c976111960e6e54a6b1fff724f6e3d39406c",
              "status": "affected",
              "version": "0747259d13febfcc838980a63c414c9b920cea6f",
              "versionType": "git"
            },
            {
              "lessThan": "1edc2feb9c759a9883dfe81cb5ed231412d8b2e4",
              "status": "affected",
              "version": "0747259d13febfcc838980a63c414c9b920cea6f",
              "versionType": "git"
            },
            {
              "lessThan": "bf89b1f87c72df79cf76203f71fbf8349cd5c9de",
              "status": "affected",
              "version": "0747259d13febfcc838980a63c414c9b920cea6f",
              "versionType": "git"
            },
            {
              "lessThan": "e63052921f1b25a836feb1500b841bff7a4a0456",
              "status": "affected",
              "version": "0747259d13febfcc838980a63c414c9b920cea6f",
              "versionType": "git"
            },
            {
              "lessThan": "c8c14adf80bd1a6e4a1d7ee9c2a816881c26d17a",
              "status": "affected",
              "version": "0747259d13febfcc838980a63c414c9b920cea6f",
              "versionType": "git"
            },
            {
              "lessThan": "d02d2c98d25793902f65803ab853b592c7a96b29",
              "status": "affected",
              "version": "0747259d13febfcc838980a63c414c9b920cea6f",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/fs-writeback.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.2"
            },
            {
              "lessThan": "4.2",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.247",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.192",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.151",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.105",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.46",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.16.*",
              "status": "unaffected",
              "version": "6.16.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.17",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.247",
                  "versionStartIncluding": "4.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.192",
                  "versionStartIncluding": "4.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.151",
                  "versionStartIncluding": "4.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.105",
                  "versionStartIncluding": "4.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.46",
                  "versionStartIncluding": "4.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.16.6",
                  "versionStartIncluding": "4.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.17",
                  "versionStartIncluding": "4.2",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nfs: writeback: fix use-after-free in __mark_inode_dirty()\n\nAn use-after-free issue occurred when __mark_inode_dirty() get the\nbdi_writeback that was in the progress of switching.\n\nCPU: 1 PID: 562 Comm: systemd-random- Not tainted 6.6.56-gb4403bd46a8e #1\n......\npstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)\npc : __mark_inode_dirty+0x124/0x418\nlr : __mark_inode_dirty+0x118/0x418\nsp : ffffffc08c9dbbc0\n........\nCall trace:\n __mark_inode_dirty+0x124/0x418\n generic_update_time+0x4c/0x60\n file_modified+0xcc/0xd0\n ext4_buffered_write_iter+0x58/0x124\n ext4_file_write_iter+0x54/0x704\n vfs_write+0x1c0/0x308\n ksys_write+0x74/0x10c\n __arm64_sys_write+0x1c/0x28\n invoke_syscall+0x48/0x114\n el0_svc_common.constprop.0+0xc0/0xe0\n do_el0_svc+0x1c/0x28\n el0_svc+0x40/0xe4\n el0t_64_sync_handler+0x120/0x12c\n el0t_64_sync+0x194/0x198\n\nRoot cause is:\n\nsystemd-random-seed                         kworker\n----------------------------------------------------------------------\n___mark_inode_dirty                     inode_switch_wbs_work_fn\n\n  spin_lock(\u0026inode-\u003ei_lock);\n  inode_attach_wb\n  locked_inode_to_wb_and_lock_list\n     get inode-\u003ei_wb\n     spin_unlock(\u0026inode-\u003ei_lock);\n     spin_lock(\u0026wb-\u003elist_lock)\n  spin_lock(\u0026inode-\u003ei_lock)\n  inode_io_list_move_locked\n  spin_unlock(\u0026wb-\u003elist_lock)\n  spin_unlock(\u0026inode-\u003ei_lock)\n                                    spin_lock(\u0026old_wb-\u003elist_lock)\n                                      inode_do_switch_wbs\n                                        spin_lock(\u0026inode-\u003ei_lock)\n                                        inode-\u003ei_wb = new_wb\n                                        spin_unlock(\u0026inode-\u003ei_lock)\n                                    spin_unlock(\u0026old_wb-\u003elist_lock)\n                                    wb_put_many(old_wb, nr_switched)\n                                      cgwb_release\n                                      old wb released\n  wb_wakeup_delayed() accesses wb,\n  then trigger the use-after-free\n  issue\n\nFix this race condition by holding inode spinlock until\nwb_wakeup_delayed() finished."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable code is reached from an ordinary write(2) syscall (vfs_write \u2192 ext4_buffered_write_iter \u2192 file_modified \u2192 generic_update_time \u2192 __mark_inode_dirty), and the competing side requires local cgroup/writeback activity. No network protocol handler is involved.\nAC:L - The attacker drives both sides of the race \u2014 a multi-threaded write() loop dirties the inode while the attacker forces cgroup writeback switches by dirtying the file from a second memcg and tearing that cgroup down, making the old wb\u0027s last reference drop. Attempts are unlimited and the bug was observed occurring spontaneously during normal boot, and CONFIG_CGROUP_WRITEBACK is default-y on all mainstream kernels.\nPR:L - Only an unprivileged local account with write access to a file on a writeback-capable filesystem (ext4/xfs home or /tmp) is needed; cgroup manipulation used to widen the race is available to ordinary users through systemd\u0027s delegated per-user cgroup subtree.\nUI:N - The attacker triggers everything itself through its own write() syscalls and cgroup activity; no victim action or interaction is required.\nS:U - The use-after-free corrupts kernel heap memory within the same kernel security authority; there is no VM, IOMMU, or sandbox boundary crossed.\nC:H - The freed bdi_writeback is dereferenced as `wb-\u003ebdi-\u003ecapabilities`, so a re-sprayed object yields an attacker-controlled pointer dereference and an arbitrary kernel-memory read primitive, enabling disclosure of arbitrary kernel data.\nI:H - wb_wakeup_delayed() writes into the freed object (spin_lock_irq on wb-\u003ework_lock) and inserts the freed `wb-\u003edwork` timer into the timer wheel, giving list-write primitives and an attacker-controlled `timer-\u003efunction` \u2014 a direct control-flow hijack path to arbitrary kernel code execution.\nA:H - The use-after-free reliably produces a kernel oops/panic as reported in the original crash trace (__mark_inode_dirty+0x124), and can be triggered repeatedly to crash the system."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:05:45.584Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/e2a14bbae5d8bacaa301362744a110e2be40a3a3"
        },
        {
          "url": "https://git.kernel.org/stable/c/b187c976111960e6e54a6b1fff724f6e3d39406c"
        },
        {
          "url": "https://git.kernel.org/stable/c/1edc2feb9c759a9883dfe81cb5ed231412d8b2e4"
        },
        {
          "url": "https://git.kernel.org/stable/c/bf89b1f87c72df79cf76203f71fbf8349cd5c9de"
        },
        {
          "url": "https://git.kernel.org/stable/c/e63052921f1b25a836feb1500b841bff7a4a0456"
        },
        {
          "url": "https://git.kernel.org/stable/c/c8c14adf80bd1a6e4a1d7ee9c2a816881c26d17a"
        },
        {
          "url": "https://git.kernel.org/stable/c/d02d2c98d25793902f65803ab853b592c7a96b29"
        }
      ],
      "title": "fs: writeback: fix use-after-free in __mark_inode_dirty()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-39866",
    "datePublished": "2025-09-19T15:26:35.725Z",
    "dateReserved": "2025-04-16T07:20:57.143Z",
    "dateUpdated": "2026-09-08T08:42:30.193Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-39876 (GCVE-0-2025-39876)

Vulnerability from cvelistv5 – Published: 2025-09-23 06:00 – Updated: 2026-05-23 16:00

Title

net: fec: Fix possible NPD in fec_enet_phy_reset_after_clk_enable()

Summary

In the Linux kernel, the following vulnerability has been resolved: net: fec: Fix possible NPD in fec_enet_phy_reset_after_clk_enable() The function of_phy_find_device may return NULL, so we need to take care before dereferencing phy_dev.

Severity

No CVSS data available.

Assigner

Linux mitre root

References

9 references

URL	Tags
https://git.kernel.org/stable/c/8c60d12bba14dc655…
https://git.kernel.org/stable/c/20a3433d31c2d2bf7…
https://git.kernel.org/stable/c/93a699d6e92cfdfa9…
https://git.kernel.org/stable/c/5f1bb554a131e59b2…
https://git.kernel.org/stable/c/fe78891f296ac05bf…
https://git.kernel.org/stable/c/4fe53aaa4271a72fe…
https://git.kernel.org/stable/c/eb148d85e126c47d6…
https://git.kernel.org/stable/c/03e79de4608bdd48a…
https://lists.debian.org/debian-lts-announce/2025…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: 9e70485b40c8306298adea8bdc867ca27f88955a , < 8c60d12bba14dc655d2d948b1dbf390b3ae39cb8 (git) Affected: 64a632da538a6827fad0ea461925cedb9899ebe2 , < 20a3433d31c2d2bf70ab0abec75f3136b42ae66c (git) Affected: 64a632da538a6827fad0ea461925cedb9899ebe2 , < 93a699d6e92cfdfa9eb9dbb8c653b5322542ca4f (git) Affected: 64a632da538a6827fad0ea461925cedb9899ebe2 , < 5f1bb554a131e59b28482abad21f691390651752 (git) Affected: 64a632da538a6827fad0ea461925cedb9899ebe2 , < fe78891f296ac05bf4e5295c9829ef822f3c32e7 (git) Affected: 64a632da538a6827fad0ea461925cedb9899ebe2 , < 4fe53aaa4271a72fe5fe3e88a45ce01646b68dc5 (git) Affected: 64a632da538a6827fad0ea461925cedb9899ebe2 , < eb148d85e126c47d65be34f2a465d69432ca5541 (git) Affected: 64a632da538a6827fad0ea461925cedb9899ebe2 , < 03e79de4608bdd48ad6eec272e196124cefaf798 (git) Affected: c068e505f229ca5f778f825f1401817ce818e917 (git) Affected: 8a6ab151443cd71e2aa5e8b7014e3453dbd51935 (git) Affected: ce88b5f42868ef4964c497d4dfcd25e88fd60c5b (git) Affected: 5.4.73 , < 5.4.300 (semver) Affected: 4.19.153 , < 4.20 (semver) Affected: 5.8.17 , < 5.9 (semver) Affected: 5.9.2 , < 5.10 (semver)
Linux	Linux	Affected: 5.10 Unaffected: 0 , < 5.10 (semver) Unaffected: 5.4.300 , ≤ 5.4.* (semver) Unaffected: 5.10.245 , ≤ 5.10.* (semver) Unaffected: 5.15.194 , ≤ 5.15.* (semver) Unaffected: 6.1.153 , ≤ 6.1.* (semver) Unaffected: 6.6.107 , ≤ 6.6.* (semver) Unaffected: 6.12.48 , ≤ 6.12.* (semver) Unaffected: 6.16.8 , ≤ 6.16.* (semver) Unaffected: 6.17 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T17:44:21.070Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/freescale/fec_main.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "8c60d12bba14dc655d2d948b1dbf390b3ae39cb8",
              "status": "affected",
              "version": "9e70485b40c8306298adea8bdc867ca27f88955a",
              "versionType": "git"
            },
            {
              "lessThan": "20a3433d31c2d2bf70ab0abec75f3136b42ae66c",
              "status": "affected",
              "version": "64a632da538a6827fad0ea461925cedb9899ebe2",
              "versionType": "git"
            },
            {
              "lessThan": "93a699d6e92cfdfa9eb9dbb8c653b5322542ca4f",
              "status": "affected",
              "version": "64a632da538a6827fad0ea461925cedb9899ebe2",
              "versionType": "git"
            },
            {
              "lessThan": "5f1bb554a131e59b28482abad21f691390651752",
              "status": "affected",
              "version": "64a632da538a6827fad0ea461925cedb9899ebe2",
              "versionType": "git"
            },
            {
              "lessThan": "fe78891f296ac05bf4e5295c9829ef822f3c32e7",
              "status": "affected",
              "version": "64a632da538a6827fad0ea461925cedb9899ebe2",
              "versionType": "git"
            },
            {
              "lessThan": "4fe53aaa4271a72fe5fe3e88a45ce01646b68dc5",
              "status": "affected",
              "version": "64a632da538a6827fad0ea461925cedb9899ebe2",
              "versionType": "git"
            },
            {
              "lessThan": "eb148d85e126c47d65be34f2a465d69432ca5541",
              "status": "affected",
              "version": "64a632da538a6827fad0ea461925cedb9899ebe2",
              "versionType": "git"
            },
            {
              "lessThan": "03e79de4608bdd48ad6eec272e196124cefaf798",
              "status": "affected",
              "version": "64a632da538a6827fad0ea461925cedb9899ebe2",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "c068e505f229ca5f778f825f1401817ce818e917",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "8a6ab151443cd71e2aa5e8b7014e3453dbd51935",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "ce88b5f42868ef4964c497d4dfcd25e88fd60c5b",
              "versionType": "git"
            },
            {
              "lessThan": "5.4.300",
              "status": "affected",
              "version": "5.4.73",
              "versionType": "semver"
            },
            {
              "lessThan": "4.20",
              "status": "affected",
              "version": "4.19.153",
              "versionType": "semver"
            },
            {
              "lessThan": "5.9",
              "status": "affected",
              "version": "5.8.17",
              "versionType": "semver"
            },
            {
              "lessThan": "5.10",
              "status": "affected",
              "version": "5.9.2",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/freescale/fec_main.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.10"
            },
            {
              "lessThan": "5.10",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.300",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.245",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.194",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.153",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.107",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.48",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.16.*",
              "status": "unaffected",
              "version": "6.16.8",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.17",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.300",
                  "versionStartIncluding": "5.4.73",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.245",
                  "versionStartIncluding": "5.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.194",
                  "versionStartIncluding": "5.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.153",
                  "versionStartIncluding": "5.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.107",
                  "versionStartIncluding": "5.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.48",
                  "versionStartIncluding": "5.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.16.8",
                  "versionStartIncluding": "5.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.17",
                  "versionStartIncluding": "5.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "4.19.153",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "5.8.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "5.9.2",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: fec: Fix possible NPD in fec_enet_phy_reset_after_clk_enable()\n\nThe function of_phy_find_device may return NULL, so we need to take\ncare before dereferencing phy_dev."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-23T16:00:56.017Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/8c60d12bba14dc655d2d948b1dbf390b3ae39cb8"
        },
        {
          "url": "https://git.kernel.org/stable/c/20a3433d31c2d2bf70ab0abec75f3136b42ae66c"
        },
        {
          "url": "https://git.kernel.org/stable/c/93a699d6e92cfdfa9eb9dbb8c653b5322542ca4f"
        },
        {
          "url": "https://git.kernel.org/stable/c/5f1bb554a131e59b28482abad21f691390651752"
        },
        {
          "url": "https://git.kernel.org/stable/c/fe78891f296ac05bf4e5295c9829ef822f3c32e7"
        },
        {
          "url": "https://git.kernel.org/stable/c/4fe53aaa4271a72fe5fe3e88a45ce01646b68dc5"
        },
        {
          "url": "https://git.kernel.org/stable/c/eb148d85e126c47d65be34f2a465d69432ca5541"
        },
        {
          "url": "https://git.kernel.org/stable/c/03e79de4608bdd48ad6eec272e196124cefaf798"
        }
      ],
      "title": "net: fec: Fix possible NPD in fec_enet_phy_reset_after_clk_enable()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-39876",
    "datePublished": "2025-09-23T06:00:47.731Z",
    "dateReserved": "2025-04-16T07:20:57.144Z",
    "dateUpdated": "2026-05-23T16:00:56.017Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-39911 (GCVE-0-2025-39911)

Vulnerability from cvelistv5 – Published: 2025-10-01 07:44 – Updated: 2026-06-11 18:44

Title

i40e: fix IRQ freeing in i40e_vsi_request_irq_msix error path

Summary

In the Linux kernel, the following vulnerability has been resolved: i40e: fix IRQ freeing in i40e_vsi_request_irq_msix error path If request_irq() in i40e_vsi_request_irq_msix() fails in an iteration later than the first, the error path wants to free the IRQs requested so far. However, it uses the wrong dev_id argument for free_irq(), so it does not free the IRQs correctly and instead triggers the warning: Trying to free already-free IRQ 173 WARNING: CPU: 25 PID: 1091 at kernel/irq/manage.c:1829 __free_irq+0x192/0x2c0 Modules linked in: i40e(+) [...] CPU: 25 UID: 0 PID: 1091 Comm: NetworkManager Not tainted 6.17.0-rc1+ #1 PREEMPT(lazy) Hardware name: [...] RIP: 0010:__free_irq+0x192/0x2c0 [...] Call Trace: <TASK> free_irq+0x32/0x70 i40e_vsi_request_irq_msix.cold+0x63/0x8b [i40e] i40e_vsi_request_irq+0x79/0x80 [i40e] i40e_vsi_open+0x21f/0x2f0 [i40e] i40e_open+0x63/0x130 [i40e] __dev_open+0xfc/0x210 __dev_change_flags+0x1fc/0x240 netif_change_flags+0x27/0x70 do_setlink.isra.0+0x341/0xc70 rtnl_newlink+0x468/0x860 rtnetlink_rcv_msg+0x375/0x450 netlink_rcv_skb+0x5c/0x110 netlink_unicast+0x288/0x3c0 netlink_sendmsg+0x20d/0x430 ____sys_sendmsg+0x3a2/0x3d0 ___sys_sendmsg+0x99/0xe0 __sys_sendmsg+0x8a/0xf0 do_syscall_64+0x82/0x2c0 entry_SYSCALL_64_after_hwframe+0x76/0x7e [...] </TASK> ---[ end trace 0000000000000000 ]--- Use the same dev_id for free_irq() as for request_irq(). I tested this with inserting code to fail intentionally.

Severity

No CVSS data available.

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-06-10 20:40 UTC

Assigner

Linux mitre root

References

9 references

URL	Tags
https://git.kernel.org/stable/c/13ab9adef3cd38651…
https://git.kernel.org/stable/c/6e4016c0dca53afc7…
https://git.kernel.org/stable/c/b9721a023df38cf44…
https://git.kernel.org/stable/c/b905b2acb3a0bbb08…
https://git.kernel.org/stable/c/23431998a37764c46…
https://git.kernel.org/stable/c/a30afd6617c30aaa3…
https://git.kernel.org/stable/c/c62580674ce5feb1b…
https://git.kernel.org/stable/c/915470e1b44e71d1d…
https://lists.debian.org/debian-lts-announce/2025…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: 493fb30011b3ab5173cef96f1d1ce126da051792 , < 13ab9adef3cd386511c930a9660ae06595007f89 (git) Affected: 493fb30011b3ab5173cef96f1d1ce126da051792 , < 6e4016c0dca53afc71e3b99e24252b63417395df (git) Affected: 493fb30011b3ab5173cef96f1d1ce126da051792 , < b9721a023df38cf44a88f2739b4cf51efd051f85 (git) Affected: 493fb30011b3ab5173cef96f1d1ce126da051792 , < b905b2acb3a0bbb08ad9be9984d8cdabdf827315 (git) Affected: 493fb30011b3ab5173cef96f1d1ce126da051792 , < 23431998a37764c464737b855c71a81d50992e98 (git) Affected: 493fb30011b3ab5173cef96f1d1ce126da051792 , < a30afd6617c30aaa338d1dbcb1e34e7a1890085c (git) Affected: 493fb30011b3ab5173cef96f1d1ce126da051792 , < c62580674ce5feb1be4f90b5873ff3ce50e0a1db (git) Affected: 493fb30011b3ab5173cef96f1d1ce126da051792 , < 915470e1b44e71d1dd07ee067276f003c3521ee3 (git)
Linux	Linux	Affected: 3.13 Unaffected: 0 , < 3.13 (semver) Unaffected: 5.4.300 , ≤ 5.4.* (semver) Unaffected: 5.10.245 , ≤ 5.10.* (semver) Unaffected: 5.15.194 , ≤ 5.15.* (semver) Unaffected: 6.1.153 , ≤ 6.1.* (semver) Unaffected: 6.6.107 , ≤ 6.6.* (semver) Unaffected: 6.12.48 , ≤ 6.12.* (semver) Unaffected: 6.16.8 , ≤ 6.16.* (semver) Unaffected: 6.17 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T17:44:36.010Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-39911",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-10T20:40:48.250837Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-11T18:44:05.563Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/intel/i40e/i40e_main.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "13ab9adef3cd386511c930a9660ae06595007f89",
              "status": "affected",
              "version": "493fb30011b3ab5173cef96f1d1ce126da051792",
              "versionType": "git"
            },
            {
              "lessThan": "6e4016c0dca53afc71e3b99e24252b63417395df",
              "status": "affected",
              "version": "493fb30011b3ab5173cef96f1d1ce126da051792",
              "versionType": "git"
            },
            {
              "lessThan": "b9721a023df38cf44a88f2739b4cf51efd051f85",
              "status": "affected",
              "version": "493fb30011b3ab5173cef96f1d1ce126da051792",
              "versionType": "git"
            },
            {
              "lessThan": "b905b2acb3a0bbb08ad9be9984d8cdabdf827315",
              "status": "affected",
              "version": "493fb30011b3ab5173cef96f1d1ce126da051792",
              "versionType": "git"
            },
            {
              "lessThan": "23431998a37764c464737b855c71a81d50992e98",
              "status": "affected",
              "version": "493fb30011b3ab5173cef96f1d1ce126da051792",
              "versionType": "git"
            },
            {
              "lessThan": "a30afd6617c30aaa338d1dbcb1e34e7a1890085c",
              "status": "affected",
              "version": "493fb30011b3ab5173cef96f1d1ce126da051792",
              "versionType": "git"
            },
            {
              "lessThan": "c62580674ce5feb1be4f90b5873ff3ce50e0a1db",
              "status": "affected",
              "version": "493fb30011b3ab5173cef96f1d1ce126da051792",
              "versionType": "git"
            },
            {
              "lessThan": "915470e1b44e71d1dd07ee067276f003c3521ee3",
              "status": "affected",
              "version": "493fb30011b3ab5173cef96f1d1ce126da051792",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/intel/i40e/i40e_main.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.13"
            },
            {
              "lessThan": "3.13",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.300",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.245",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.194",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.153",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.107",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.48",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.16.*",
              "status": "unaffected",
              "version": "6.16.8",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.17",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.300",
                  "versionStartIncluding": "3.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.245",
                  "versionStartIncluding": "3.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.194",
                  "versionStartIncluding": "3.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.153",
                  "versionStartIncluding": "3.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.107",
                  "versionStartIncluding": "3.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.48",
                  "versionStartIncluding": "3.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.16.8",
                  "versionStartIncluding": "3.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.17",
                  "versionStartIncluding": "3.13",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ni40e: fix IRQ freeing in i40e_vsi_request_irq_msix error path\n\nIf request_irq() in i40e_vsi_request_irq_msix() fails in an iteration\nlater than the first, the error path wants to free the IRQs requested\nso far. However, it uses the wrong dev_id argument for free_irq(), so\nit does not free the IRQs correctly and instead triggers the warning:\n\n Trying to free already-free IRQ 173\n WARNING: CPU: 25 PID: 1091 at kernel/irq/manage.c:1829 __free_irq+0x192/0x2c0\n Modules linked in: i40e(+) [...]\n CPU: 25 UID: 0 PID: 1091 Comm: NetworkManager Not tainted 6.17.0-rc1+ #1 PREEMPT(lazy)\n Hardware name: [...]\n RIP: 0010:__free_irq+0x192/0x2c0\n [...]\n Call Trace:\n  \u003cTASK\u003e\n  free_irq+0x32/0x70\n  i40e_vsi_request_irq_msix.cold+0x63/0x8b [i40e]\n  i40e_vsi_request_irq+0x79/0x80 [i40e]\n  i40e_vsi_open+0x21f/0x2f0 [i40e]\n  i40e_open+0x63/0x130 [i40e]\n  __dev_open+0xfc/0x210\n  __dev_change_flags+0x1fc/0x240\n  netif_change_flags+0x27/0x70\n  do_setlink.isra.0+0x341/0xc70\n  rtnl_newlink+0x468/0x860\n  rtnetlink_rcv_msg+0x375/0x450\n  netlink_rcv_skb+0x5c/0x110\n  netlink_unicast+0x288/0x3c0\n  netlink_sendmsg+0x20d/0x430\n  ____sys_sendmsg+0x3a2/0x3d0\n  ___sys_sendmsg+0x99/0xe0\n  __sys_sendmsg+0x8a/0xf0\n  do_syscall_64+0x82/0x2c0\n  entry_SYSCALL_64_after_hwframe+0x76/0x7e\n  [...]\n  \u003c/TASK\u003e\n ---[ end trace 0000000000000000 ]---\n\nUse the same dev_id for free_irq() as for request_irq().\n\nI tested this with inserting code to fail intentionally."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T21:38:47.535Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/13ab9adef3cd386511c930a9660ae06595007f89"
        },
        {
          "url": "https://git.kernel.org/stable/c/6e4016c0dca53afc71e3b99e24252b63417395df"
        },
        {
          "url": "https://git.kernel.org/stable/c/b9721a023df38cf44a88f2739b4cf51efd051f85"
        },
        {
          "url": "https://git.kernel.org/stable/c/b905b2acb3a0bbb08ad9be9984d8cdabdf827315"
        },
        {
          "url": "https://git.kernel.org/stable/c/23431998a37764c464737b855c71a81d50992e98"
        },
        {
          "url": "https://git.kernel.org/stable/c/a30afd6617c30aaa338d1dbcb1e34e7a1890085c"
        },
        {
          "url": "https://git.kernel.org/stable/c/c62580674ce5feb1be4f90b5873ff3ce50e0a1db"
        },
        {
          "url": "https://git.kernel.org/stable/c/915470e1b44e71d1dd07ee067276f003c3521ee3"
        }
      ],
      "title": "i40e: fix IRQ freeing in i40e_vsi_request_irq_msix error path",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-39911",
    "datePublished": "2025-10-01T07:44:34.561Z",
    "dateReserved": "2025-04-16T07:20:57.147Z",
    "dateUpdated": "2026-06-11T18:44:05.563Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-39923 (GCVE-0-2025-39923)

Vulnerability from cvelistv5 – Published: 2025-10-01 08:07 – Updated: 2026-05-23 16:00

Title

dmaengine: qcom: bam_dma: Fix DT error handling for num-channels/ees

Summary

In the Linux kernel, the following vulnerability has been resolved: dmaengine: qcom: bam_dma: Fix DT error handling for num-channels/ees When we don't have a clock specified in the device tree, we have no way to ensure the BAM is on. This is often the case for remotely-controlled or remotely-powered BAM instances. In this case, we need to read num-channels from the DT to have all the necessary information to complete probing. However, at the moment invalid device trees without clock and without num-channels still continue probing, because the error handling is missing return statements. The driver will then later try to read the number of channels from the registers. This is unsafe, because it relies on boot firmware and lucky timing to succeed. Unfortunately, the lack of proper error handling here has been abused for several Qualcomm SoCs upstream, causing early boot crashes in several situations [1, 2]. Avoid these early crashes by erroring out when any of the required DT properties are missing. Note that this will break some of the existing DTs upstream (mainly BAM instances related to the crypto engine). However, clearly these DTs have never been tested properly, since the error in the kernel log was just ignored. It's safer to disable the crypto engine for these broken DTBs. [1]: https://lore.kernel.org/r/CY01EKQVWE36.B9X5TDXAREPF@fairphone.com/ [2]: https://lore.kernel.org/r/20230626145959.646747-1-krzysztof.kozlowski@linaro.org/

Severity

No CVSS data available.

Assigner

Linux mitre root

References

9 references

URL	Tags
https://git.kernel.org/stable/c/2e257a6125c63350f…
https://git.kernel.org/stable/c/1d98ba204d8a6db0d…
https://git.kernel.org/stable/c/6ac1599d0e78036d9…
https://git.kernel.org/stable/c/555bd16351a35c79e…
https://git.kernel.org/stable/c/ebf6c7c908e599953…
https://git.kernel.org/stable/c/1fc14731f0be4885e…
https://git.kernel.org/stable/c/0ff9df758af7022d7…
https://git.kernel.org/stable/c/5068b5254812433e8…
https://lists.debian.org/debian-lts-announce/2025…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: 48d163b1aa6e7f650c0b7a4f9c61c387a6def868 , < 2e257a6125c63350f00dc42b9674f20fd3cf4a9f (git) Affected: 48d163b1aa6e7f650c0b7a4f9c61c387a6def868 , < 1d98ba204d8a6db0d986c7f1aefaa0dcd1c007a2 (git) Affected: 48d163b1aa6e7f650c0b7a4f9c61c387a6def868 , < 6ac1599d0e78036d9d08efc2f58c2d91f0a3ee4c (git) Affected: 48d163b1aa6e7f650c0b7a4f9c61c387a6def868 , < 555bd16351a35c79efb029a196975a5a27f7fbc4 (git) Affected: 48d163b1aa6e7f650c0b7a4f9c61c387a6def868 , < ebf6c7c908e5999531c3517289598f187776124f (git) Affected: 48d163b1aa6e7f650c0b7a4f9c61c387a6def868 , < 1fc14731f0be4885e60702b9596d14d9a79cf053 (git) Affected: 48d163b1aa6e7f650c0b7a4f9c61c387a6def868 , < 0ff9df758af7022d749718fb6b8385cc5693acf3 (git) Affected: 48d163b1aa6e7f650c0b7a4f9c61c387a6def868 , < 5068b5254812433e841a40886e695633148d362d (git) Affected: cecf8a69042b3a54cb843223756c10ee8a8665e3 (git) Affected: 909474cd384cb206f33461fbd18089cf170533f8 (git) Affected: 5e0986f7caf17d7b1acd2092975360bf8e88a57d (git) Affected: 4.9.104 , < 4.10 (semver) Affected: 4.14.45 , < 4.15 (semver) Affected: 4.16.13 , < 4.17 (semver)
Linux	Linux	Affected: 4.17 Unaffected: 0 , < 4.17 (semver) Unaffected: 5.4.300 , ≤ 5.4.* (semver) Unaffected: 5.10.245 , ≤ 5.10.* (semver) Unaffected: 5.15.194 , ≤ 5.15.* (semver) Unaffected: 6.1.153 , ≤ 6.1.* (semver) Unaffected: 6.6.107 , ≤ 6.6.* (semver) Unaffected: 6.12.48 , ≤ 6.12.* (semver) Unaffected: 6.16.8 , ≤ 6.16.* (semver) Unaffected: 6.17 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T17:44:41.678Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/dma/qcom/bam_dma.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "2e257a6125c63350f00dc42b9674f20fd3cf4a9f",
              "status": "affected",
              "version": "48d163b1aa6e7f650c0b7a4f9c61c387a6def868",
              "versionType": "git"
            },
            {
              "lessThan": "1d98ba204d8a6db0d986c7f1aefaa0dcd1c007a2",
              "status": "affected",
              "version": "48d163b1aa6e7f650c0b7a4f9c61c387a6def868",
              "versionType": "git"
            },
            {
              "lessThan": "6ac1599d0e78036d9d08efc2f58c2d91f0a3ee4c",
              "status": "affected",
              "version": "48d163b1aa6e7f650c0b7a4f9c61c387a6def868",
              "versionType": "git"
            },
            {
              "lessThan": "555bd16351a35c79efb029a196975a5a27f7fbc4",
              "status": "affected",
              "version": "48d163b1aa6e7f650c0b7a4f9c61c387a6def868",
              "versionType": "git"
            },
            {
              "lessThan": "ebf6c7c908e5999531c3517289598f187776124f",
              "status": "affected",
              "version": "48d163b1aa6e7f650c0b7a4f9c61c387a6def868",
              "versionType": "git"
            },
            {
              "lessThan": "1fc14731f0be4885e60702b9596d14d9a79cf053",
              "status": "affected",
              "version": "48d163b1aa6e7f650c0b7a4f9c61c387a6def868",
              "versionType": "git"
            },
            {
              "lessThan": "0ff9df758af7022d749718fb6b8385cc5693acf3",
              "status": "affected",
              "version": "48d163b1aa6e7f650c0b7a4f9c61c387a6def868",
              "versionType": "git"
            },
            {
              "lessThan": "5068b5254812433e841a40886e695633148d362d",
              "status": "affected",
              "version": "48d163b1aa6e7f650c0b7a4f9c61c387a6def868",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "cecf8a69042b3a54cb843223756c10ee8a8665e3",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "909474cd384cb206f33461fbd18089cf170533f8",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "5e0986f7caf17d7b1acd2092975360bf8e88a57d",
              "versionType": "git"
            },
            {
              "lessThan": "4.10",
              "status": "affected",
              "version": "4.9.104",
              "versionType": "semver"
            },
            {
              "lessThan": "4.15",
              "status": "affected",
              "version": "4.14.45",
              "versionType": "semver"
            },
            {
              "lessThan": "4.17",
              "status": "affected",
              "version": "4.16.13",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/dma/qcom/bam_dma.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.17"
            },
            {
              "lessThan": "4.17",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.300",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.245",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.194",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.153",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.107",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.48",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.16.*",
              "status": "unaffected",
              "version": "6.16.8",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.17",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.300",
                  "versionStartIncluding": "4.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.245",
                  "versionStartIncluding": "4.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.194",
                  "versionStartIncluding": "4.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.153",
                  "versionStartIncluding": "4.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.107",
                  "versionStartIncluding": "4.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.48",
                  "versionStartIncluding": "4.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.16.8",
                  "versionStartIncluding": "4.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.17",
                  "versionStartIncluding": "4.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "4.9.104",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "4.14.45",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "4.16.13",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndmaengine: qcom: bam_dma: Fix DT error handling for num-channels/ees\n\nWhen we don\u0027t have a clock specified in the device tree, we have no way to\nensure the BAM is on. This is often the case for remotely-controlled or\nremotely-powered BAM instances. In this case, we need to read num-channels\nfrom the DT to have all the necessary information to complete probing.\n\nHowever, at the moment invalid device trees without clock and without\nnum-channels still continue probing, because the error handling is missing\nreturn statements. The driver will then later try to read the number of\nchannels from the registers. This is unsafe, because it relies on boot\nfirmware and lucky timing to succeed. Unfortunately, the lack of proper\nerror handling here has been abused for several Qualcomm SoCs upstream,\ncausing early boot crashes in several situations [1, 2].\n\nAvoid these early crashes by erroring out when any of the required DT\nproperties are missing. Note that this will break some of the existing DTs\nupstream (mainly BAM instances related to the crypto engine). However,\nclearly these DTs have never been tested properly, since the error in the\nkernel log was just ignored. It\u0027s safer to disable the crypto engine for\nthese broken DTBs.\n\n[1]: https://lore.kernel.org/r/CY01EKQVWE36.B9X5TDXAREPF@fairphone.com/\n[2]: https://lore.kernel.org/r/20230626145959.646747-1-krzysztof.kozlowski@linaro.org/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-23T16:00:59.237Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/2e257a6125c63350f00dc42b9674f20fd3cf4a9f"
        },
        {
          "url": "https://git.kernel.org/stable/c/1d98ba204d8a6db0d986c7f1aefaa0dcd1c007a2"
        },
        {
          "url": "https://git.kernel.org/stable/c/6ac1599d0e78036d9d08efc2f58c2d91f0a3ee4c"
        },
        {
          "url": "https://git.kernel.org/stable/c/555bd16351a35c79efb029a196975a5a27f7fbc4"
        },
        {
          "url": "https://git.kernel.org/stable/c/ebf6c7c908e5999531c3517289598f187776124f"
        },
        {
          "url": "https://git.kernel.org/stable/c/1fc14731f0be4885e60702b9596d14d9a79cf053"
        },
        {
          "url": "https://git.kernel.org/stable/c/0ff9df758af7022d749718fb6b8385cc5693acf3"
        },
        {
          "url": "https://git.kernel.org/stable/c/5068b5254812433e841a40886e695633148d362d"
        }
      ],
      "title": "dmaengine: qcom: bam_dma: Fix DT error handling for num-channels/ees",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-39923",
    "datePublished": "2025-10-01T08:07:11.469Z",
    "dateReserved": "2025-04-16T07:20:57.147Z",
    "dateUpdated": "2026-05-23T16:00:59.237Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.

Action not permitted

SUSE-SU-2025:4189-1

CVE-2025-39724 (GCVE-0-2025-39724)

CVE-2025-39756 (GCVE-0-2025-39756)

CVE-2025-39772 (GCVE-0-2025-39772)

CVE-2025-39812 (GCVE-0-2025-39812)

CVE-2025-39813 (GCVE-0-2025-39813)

CVE-2025-39841 (GCVE-0-2025-39841)

CVE-2025-39866 (GCVE-0-2025-39866)

CVE-2025-39876 (GCVE-0-2025-39876)

CVE-2025-39911 (GCVE-0-2025-39911)

CVE-2025-39923 (GCVE-0-2025-39923)

Tags

Sightings

Nomenclature