PT-2025-36276 · Linux +2 · Linux Kernel +2

Published 2025-01-01 · Updated 2025-09-06 · CVE-2025-39681

Positive Technologies · (AI Summary)

Name of the Vulnerable Software and Affected Versions:

Linux kernel versions prior to 923f3a2b48bd

Description:

A division by zero fault can occur during the early booting stage on machines with X86 FEATURE CQM* supported. This is due to `get rdt mon resources()` attempting to calculate `mon l3 config` with an uninitialized `boot cpu data.x86 cache occ scale`. The issue arises because `resctrl cpu detect()` was moved to a vendor-specific BSP init helper but was not implemented in Hygon’s code.

Recommendations:

Update the Linux kernel to a version after commit 923f3a2b48bd.

Related Identifiers

CVE-2025-39681

Affected Products

Debian

Hygon

Linux Kernel

References · 12

• https://security-tracker.debian.org/tracker/source-package/linux · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-39681 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2025-39681 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-39681 · Security Note
• https://twitter.com/CVEnew/status/1964195472341688818 · Twitter Post
• https://git.kernel.org/stable/c/d8df126349dad855cdfedd6bbf315bad2e901c2f · Note
• https://git.kernel.org/stable/c/fb81222c1559f89bfe3aa1010f6d112531d55353 · Note
• https://git.kernel.org/stable/c/7207923d8453ebfb35667c1736169f2dd796772e · Note
• https://git.kernel.org/stable/c/d23264c257a70dbe021b43b3bc2ee16134cd2c69 · Note
• https://git.kernel.org/stable/c/873f32201df8876bdb2563e3187e79149427cab4 · Note
• https://packages.debian.org/src:linux · Note
• https://git.kernel.org/stable/c/a9e5924daa954c9f585c1ca00358afe71d6781c4 · Note