CVE-2025-39904

{"id": "CVE-2025-39904", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-39904", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-01-14T19:30:11.300750Z"}}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.5, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 1.8}, {"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.5, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 1.8}]}, "affected": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "affectedData": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "bf454ec31add6790f6cdc88328e38901fcbbade6", "lessThan": "340cc9a3bd30b25edaf6a9708d41b5f2c10a054a", "versionType": "git"}, {"status": "affected", "version": "bf454ec31add6790f6cdc88328e38901fcbbade6", "lessThan": "04d3cd43700a2d0fe4bfb1012a8ec7f2e34a3507", "versionType": "git"}], "programFiles": ["arch/arm64/kernel/machine_kexec_file.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "6.16"}, {"status": "unaffected", "version": "0", "lessThan": "6.16", "versionType": "semver"}, {"status": "unaffected", "version": "6.16.8", "versionType": "semver", "lessThanOrEqual": "6.16.*"}, {"status": "unaffected", "version": "6.17", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["arch/arm64/kernel/machine_kexec_file.c"], "defaultStatus": "affected"}]}], "published": "2025-10-01T08:15:33.250", "references": [{"url": "https://git.kernel.org/stable/c/04d3cd43700a2d0fe4bfb1012a8ec7f2e34a3507", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/340cc9a3bd30b25edaf6a9708d41b5f2c10a054a", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-908"}]}, {"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-908"}]}], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\narm64: kexec: initialize kexec_buf struct in load_other_segments()\n\nPatch series \"kexec: Fix invalid field access\".\n\nThe kexec_buf structure was previously declared without initialization. \ncommit bf454ec31add (\"kexec_file: allow to place kexec_buf randomly\")\nadded a field that is always read but not consistently populated by all\narchitectures. This un-initialized field will contain garbage.\n\nThis is also triggering a UBSAN warning when the uninitialized data was\naccessed:\n\n\t------------[ cut here ]------------\n\tUBSAN: invalid-load in ./include/linux/kexec.h:210:10\n\tload of value 252 is not a valid value for type '_Bool'\n\nZero-initializing kexec_buf at declaration ensures all fields are cleanly\nset, preventing future instances of uninitialized memory being used.\n\nAn initial fix was already landed for arm64[0], and this patchset fixes\nthe problem on the remaining arm64 code and on riscv, as raised by Mark.\n\nDiscussions about this problem could be found at[1][2].\n\n\nThis patch (of 3):\n\nThe kexec_buf structure was previously declared without initialization.\ncommit bf454ec31add (\"kexec_file: allow to place kexec_buf randomly\")\nadded a field that is always read but not consistently populated by all\narchitectures. This un-initialized field will contain garbage.\n\nThis is also triggering a UBSAN warning when the uninitialized data was\naccessed:\n\n\t------------[ cut here ]------------\n\tUBSAN: invalid-load in ./include/linux/kexec.h:210:10\n\tload of value 252 is not a valid value for type '_Bool'\n\nZero-initializing kexec_buf at declaration ensures all fields are\ncleanly set, preventing future instances of uninitialized memory being\nused."}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\narm64: kexec: inicializar la estructura kexec_buf en load_other_segments()\n\nSerie de parches 'kexec: Correcci\u00f3n de acceso a campo inv\u00e1lido'.\n\nLa estructura kexec_buf fue declarada previamente sin inicializaci\u00f3n.\nEl commit bf454ec31add ('kexec_file: permitir colocar kexec_buf aleatoriamente')\na\u00f1adi\u00f3 un campo que siempre se lee pero no es poblado consistentemente por todas\nlas arquitecturas. Este campo no inicializado contendr\u00e1 basura.\n\nEsto tambi\u00e9n est\u00e1 activando una advertencia de UBSAN cuando se accedi\u00f3 a los datos no inicializados:\n\n\t------------[ cortar aqu\u00ed ]------------\n\tUBSAN: carga inv\u00e1lida en ./include/linux/kexec.h:210:10\n\tcarga del valor 252 no es un valor v\u00e1lido para el tipo '_Bool'\n\nInicializar kexec_buf a cero en la declaraci\u00f3n asegura que todos los campos se establezcan limpiamente,\npreviniendo futuras instancias de memoria no inicializada siendo utilizada.\n\nUna correcci\u00f3n inicial ya fue aplicada para arm64[0], y este conjunto de parches corrige\nel problema en el c\u00f3digo arm64 restante y en riscv, como lo plante\u00f3 Mark.\n\nLas discusiones sobre este problema se pueden encontrar en[1][2].\n\nEste parche (de 3):\n\nLa estructura kexec_buf fue declarada previamente sin inicializaci\u00f3n.\nEl commit bf454ec31add ('kexec_file: permitir colocar kexec_buf aleatoriamente')\na\u00f1adi\u00f3 un campo que siempre se lee pero no es poblado consistentemente por todas\nlas arquitecturas. Este campo no inicializado contendr\u00e1 basura.\n\nEsto tambi\u00e9n est\u00e1 activando una advertencia de UBSAN cuando se accedi\u00f3 a los datos no inicializados:\n\n\t------------[ cortar aqu\u00ed ]------------\n\tUBSAN: carga inv\u00e1lida en ./include/linux/kexec.h:210:10\n\tcarga del valor 252 no es un valor v\u00e1lido para el tipo '_Bool'\n\nInicializar kexec_buf a cero en la declaraci\u00f3n asegura que todos los campos se\nestablezcan limpiamente, previniendo futuras instancias de memoria no\ninicializada siendo utilizada."}], "lastModified": "2026-10-19T21:10:00.160", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "153C3365-15EB-4E0F-A035-44F9BD7E758F", "versionEndExcluding": "6.16.8", "versionStartIncluding": "6.16"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.17:rc1:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "327D22EF-390B-454C-BD31-2ED23C998A1C"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.17:rc2:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C730CD9A-D969-4A8E-9522-162AAF7C0EE9"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.17:rc3:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "39982C4B-716E-4B2F-8196-FA301F47807D"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.17:rc4:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "340BEEA9-D70D-4290-B502-FBB1032353B1"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.17:rc5:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "47E4C5C0-079F-4838-971B-8C503D48FCC2"}], "operator": "OR"}]}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}