CVE-2025-39836: linux Out-of-bounds Write
Vulnerability summary
CVE-2025-39836 is a high (CVSS 7.8) Out-of-bounds Write vulnerability in linux. EPSS estimates a 0.15% chance of exploitation in the next 30 days, higher than 4.1% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 19 · Related 18Timeline
- 16-09-2025PublishedVulnerability first disclosed.
- 05-08-2026Last modifiedVulnerability information updated.
Description
In the Linux kernel, the following vulnerability has been resolved: efi: stmm: Fix incorrect buffer allocation method The communication buffer allocated by setup_mm_hdr() is later on passed to tee_shm_register_kernel_buf(). The latter expects those buffers to be contiguous pages, but setup_mm_hdr() just uses kmalloc(). That can cause various corruptions or BUGs, specifically since commit 9aec2fb0fd5e ("slab: allocate frozen pages"), though it was broken before as well. Fix this by using alloc_pages_exact() instead of kmalloc().
CVSS metrics
5 scores · 4 sources · 2 versions- OSV · UbuntuEcosystem advisory · calculated7.8HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- OSV · DebianEcosystem advisory · calculated7.8HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- NVDNIST7.8HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS trend
Probability
0.15%
Chance of exploitation in the next 30 days
Percentile
4%
Versus all other CVEs
30-day change
0.00 pp
From 0.15% on 20-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Ubuntu122 products
- linux< 6.8.0-106.106
- linux-allwinner-5.19All versions (No fix recorded)
- linux-aws< 6.8.0-1050.53
- linux-aws-5.0All versions (No fix recorded)
- linux-aws-5.11All versions (No fix recorded)
Linux2 products
- linux≥ c44b6be62e8dd4ee0a308c36a70620613e6fc55f, < 77ff27ff0e4529a003c8a1c2492c111968c378d3 | ≥ c44b6be62e8dd4ee0a308c36a70620613e6fc55f, < 630c0e6064daf84f17aad1a7d9ca76b562e3fe47 | ≥ c44b6be62e8dd4ee0a308c36a70620613e6fc55f, < c5e81e672699e0c5557b2b755cc8f7a69aa92bff | 6.8
- linux_kernel≥ 6.8, < 6.12.45 | ≥ 6.13, < 6.16.5 | 6.17:rc1 | 6.17:rc2 | 6.17:rc3
Debian1 product
- linux< 6.12.48-1 | < 6.16.5-1
3 vendors · 125 products
