PT-2025-40078 · Linux+1 · Linux Kernel+1

Mark · Published 2025-09-03 · Updated 2025-10-01 · CVE-2025-39904

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description The Linux kernel contains an issue where the kexec buf structure was declared without initialization. This could lead to the use of uninitialized memory, triggering a UBSAN (Undefined Behavior Sanitizer) warning when accessing an uninitialized field within the structure. The issue was identified during the loading of other segments and addressed by zero-initializing the kexec buf structure at its declaration to ensure all fields are properly set. The problem was initially observed on arm64 architectures and subsequently extended to riscv. The kexec buf structure is used in the kexec functionality, which allows for fast booting of a new kernel without going through the traditional bootloader process.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Use of Uninitialized Resource

Improper Initialization

Weakness Enumeration

CWE-908

CWE-665

Related Identifiers

BDU:2026-04329

CVE-2025-39904

Affected Products

Astra Linux

Linux Kernel

References · 17

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/39xxx/CVE-2025-39904.json · Exploit
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-39904 · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-04329 · Security Note
• https://cve.org/CVERecord?id=CVE-2025-39904 · Security Note
• https://osv.dev/vulnerability/CVE-2025-39904 · Vendor Advisory
• https://git.kernel.org/stable/c/340cc9a3bd30b25edaf6a9708d41b5f2c10a054a · Patch
• https://security-tracker.debian.org/tracker/CVE-2025-39904 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-39904 · Security Note
• https://ubuntu.com/security/CVE-2025-39904 · Vendor Advisory
• https://git.kernel.org/stable/c/04d3cd43700a2d0fe4bfb1012a8ec7f2e34a3507 · Patch
• https://osv.dev/vulnerability/DEBIAN-CVE-2025-39904 · Vendor Advisory
• https://t.me/CVEtracker/33781 · Telegram Post
• https://git.kernel.org/linus/04d3cd43700a2d0fe4bfb1012a8ec7f2e34a3507 · Note
• https://twitter.com/CVEnew/status/1973302173569028480 · Twitter Post
• https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git · Note