CVE-2025-39872

In the Linux kernel, the following vulnerability has been resolved: hsr: hold rcu and dev lock for hsr_get_port_ndev hsr_get_port_ndev calls hsr_for_each_port, which need to hold rcu lock. On the other hand, before return the port device, we need to hold the device reference to avoid UaF in the caller function.

CVSS v3 7.8 HIGH

7.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 1.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://git.kernel.org/stable/c/68a6729afd3e8e9a2a32538642ce92b96ccf9b1d	Patch
https://git.kernel.org/stable/c/847748fc66d08a89135a74e29362a66ba4e3ab15	Patch
https://git.kernel.org/stable/c/9433ba79c2ec3ec7c9a711748701549339c3438c

Configurations

Configuration 1 (hide)

OR	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel:6.17:rc1::::::
	cpe:2.3:o:linux:linux_kernel:6.17:rc2::::::
	cpe:2.3:o:linux:linux_kernel:6.17:rc3::::::
	cpe:2.3:o:linux:linux_kernel:6.17:rc4::::::
	cpe:2.3:o:linux:linux_kernel:6.17:rc5::::::

History

19 Oct 2026, 21:10

Type	Values Removed	Values Added
Summary		(es) En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta: hsr: mantener los bloqueos rcu y dev para hsr_get_port_ndev hsr_get_port_ndev llama a hsr_for_each_port, que necesita mantener el bloqueo rcu. Por otro lado, antes de devolver el dispositivo de puerto, necesitamos mantener la referencia del dispositivo para evitar UaF en la función llamadora.

Information

Published : 2025-09-23 06:15

Updated : 2026-10-19 21:10

NVD link : CVE-2025-39872

Mitre link : CVE-2025-39872

CVE.ORG link : CVE-2025-39872

JSON object : View

Products Affected

linux

linux_kernel

CWE

NVD-CWE-noinfo

{"id": "CVE-2025-39872", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.8}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.5, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 1.8}]}, "affected": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "affectedData": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "ef964411c8ca775967355d855abc56aeaca3c867", "lessThan": "9433ba79c2ec3ec7c9a711748701549339c3438c", "versionType": "git"}, {"status": "affected", "version": "9c10dd8eed74de9e8adeb820939f8745cd566d4a", "lessThan": "68a6729afd3e8e9a2a32538642ce92b96ccf9b1d", "versionType": "git"}, {"status": "affected", "version": "9c10dd8eed74de9e8adeb820939f8745cd566d4a", "lessThan": "847748fc66d08a89135a74e29362a66ba4e3ab15", "versionType": "git"}, {"status": "affected", "version": "6.12.63", "lessThan": "6.12.64", "versionType": "semver"}], "programFiles": ["drivers/net/ethernet/ti/icssg/icssg_prueth.c", "net/hsr/hsr_device.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "6.14"}, {"status": "unaffected", "version": "0", "lessThan": "6.14", "versionType": "semver"}, {"status": "unaffected", "version": "6.12.64", "versionType": "semver", "lessThanOrEqual": "6.12.*"}, {"status": "unaffected", "version": "6.16.8", "versionType": "semver", "lessThanOrEqual": "6.16.*"}, {"status": "unaffected", "version": "6.17", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["drivers/net/ethernet/ti/icssg/icssg_prueth.c", "net/hsr/hsr_device.c"], "defaultStatus": "affected"}]}], "published": "2025-09-23T06:15:46.533", "references": [{"url": "https://git.kernel.org/stable/c/68a6729afd3e8e9a2a32538642ce92b96ccf9b1d", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/847748fc66d08a89135a74e29362a66ba4e3ab15", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/9433ba79c2ec3ec7c9a711748701549339c3438c", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-noinfo"}]}], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nhsr: hold rcu and dev lock for hsr_get_port_ndev\n\nhsr_get_port_ndev calls hsr_for_each_port, which need to hold rcu lock.\nOn the other hand, before return the port device, we need to hold the\ndevice reference to avoid UaF in the caller function."}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nhsr: mantener los bloqueos rcu y dev para hsr_get_port_ndev\n\nhsr_get_port_ndev llama a hsr_for_each_port, que necesita mantener el bloqueo rcu.\nPor otro lado, antes de devolver el dispositivo de puerto, necesitamos mantener la referencia del dispositivo para evitar UaF en la funci\u00f3n llamadora."}], "lastModified": "2026-10-19T21:10:00.160", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F6C3723D-6863-4401-AC08-FEB7AB987047", "versionEndExcluding": "6.16.8", "versionStartIncluding": "6.14"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.17:rc1:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "327D22EF-390B-454C-BD31-2ED23C998A1C"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.17:rc2:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C730CD9A-D969-4A8E-9522-162AAF7C0EE9"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.17:rc3:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "39982C4B-716E-4B2F-8196-FA301F47807D"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.17:rc4:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "340BEEA9-D70D-4290-B502-FBB1032353B1"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.17:rc5:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "47E4C5C0-079F-4838-971B-8C503D48FCC2"}], "operator": "OR"}]}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}