PT-2025-40635 · Linux · Linux Kernel

Published 2025-09-05 · Updated 2025-10-04 · CVE-2025-39939

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A flaw exists in the Linux kernel’s iommu/s390 subsystem related to memory corruption when utilizing the identity domain. The zpci get iommu ctrs() function returns counter information intended for device statistics; however, when the identity domain is used, this function attempts to access memory within an uninitialized s390 domain structure, leading to a potential memory corruption issue. The issue was identified through Kernel Address Sanitizer (KASAN) reports during testing. The function zpci fmb enable device is implicated in the reported error.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Memory Corruption

Buffer Overflow

Weakness Enumeration

CWE-787

CWE-119

Related Identifiers

BDU:2026-04410

CVE-2025-39939

Affected Products

Linux Kernel

References · 17

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/39xxx/CVE-2025-39939.json · Exploit
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-39939 · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-04410 · Security Note
• https://osv.dev/vulnerability/CVE-2025-39939 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-39939 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-39939 · Security Note
• https://git.kernel.org/stable/c/17a58caf3863163c4a84a218a9649be2c8061443 · Patch
• https://security-tracker.debian.org/tracker/CVE-2025-39939 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2025-39939 · Vendor Advisory
• https://git.kernel.org/stable/c/b3506e9bcc777ed6af2ab631c86a9990ed97b474 · Patch
• https://cve.org/CVERecord?id=CVE-2025-39939 · Security Note
• https://access.redhat.com/security/cve/cve-2025-39939 · Note
• https://t.me/CVEtracker/34101 · Telegram Post
• https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git · Note
• https://kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.16.9 · Note