PT-2025-41376 · Linux · Linux Kernel

Published 2025-10-09 · Updated 2026-02-03 · CVE-2025-39962

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Linux Kernel (affected versions not specified)

Description The Linux kernel contains a flaw related to an untrusted unsigned subtract operation within the rxrpc subsystem. Specifically, a Smatch static checker warning was identified in the rxgk yfs decode ticket() function within net/rxrpc/rxgk app.c. The issue involves a potential vulnerability when subtracting values related to the length of data being extracted, potentially leading to unexpected behavior. The fix involves prechecking the length of the data being extracted and using sizeof() to determine the size of the structure being processed, ensuring consistency with other related statements.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Memory Corruption

Weakness Enumeration

CWE-787

Related Identifiers

CVE-2025-39962

Affected Products

Linux Kernel

References · 17

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/39xxx/CVE-2025-39962.json · Exploit
• https://osv.dev/vulnerability/DEBIAN-CVE-2025-39962 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-39962 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2025-39962 · Vendor Advisory
• https://git.kernel.org/stable/c/71571e187106631a8127f2dde780f35caa358d33 · Patch
• https://cve.org/CVERecord?id=CVE-2025-39962 · Security Note
• https://osv.dev/vulnerability/CVE-2025-39962 · Vendor Advisory
• https://git.kernel.org/stable/c/2429a197648178cd4dc930a9d87c13c547460564 · Patch
• https://ubuntu.com/security/CVE-2025-39962 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-39962 · Security Note
• https://t.me/cveNotify/150724 · Telegram Post
• https://twitter.com/CVEnew/status/1976263809376375029 · Twitter Post
• https://t.me/CVEtracker/34520 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1976287305250766854 · Twitter Post
• https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git · Note