CVE-2025-39920: debian debian_linux NULL Pointer Dereference
Vulnerability summary
CVE-2025-39920 is a medium (CVSS 5.5) NULL Pointer Dereference vulnerability in debian debian_linux. EPSS estimates a 0.16% chance of exploitation in the next 30 days, higher than 5.2% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 31 · Related 29Timeline
- 01-10-2025PublishedVulnerability first disclosed.
- 11-05-2026Last modifiedVulnerability information updated.
Description
In the Linux kernel, the following vulnerability has been resolved: pcmcia: Add error handling for add_interval() in do_validate_mem() In the do_validate_mem(), the call to add_interval() does not handle errors. If kmalloc() fails in add_interval(), it could result in a null pointer being inserted into the linked list, leading to illegal memory access when sub_interval() is called next. This patch adds an error handling for the add_interval(). If add_interval() returns an error, the function will return early with the error code.
CVSS metrics
3 scores · 3 sources · 1 version- OSV · UbuntuEcosystem advisory · calculated5.5MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
- OSV · DebianEcosystem advisory · calculated5.5MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
EPSS trend
Probability
0.16%
Chance of exploitation in the next 30 days
Percentile
5%
Versus all other CVEs
30-day change
0.00 pp
From 0.16% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Ubuntu148 products
- linuxAll versions (No fix recorded) | < 5.15.0-163.173 | < 6.8.0-106.106
- linux-allwinner-5.19All versions (No fix recorded)
- linux-awsAll versions (No fix recorded) | < 5.15.0-1097.104 | < 6.8.0-1050.53
- linux-aws-5.0All versions (No fix recorded)
- linux-aws-5.11All versions (No fix recorded)
Debian2 products
- linux< 6.1.153-1 | < 6.12.48-1 | < 6.16.6-1
- debian_linuxEOL11.0
Linux2 products
- linux≥ 7b4884ca8853a638df0eb5d251d80d67777b8b1a, < 5b60ed401b47897352c520bc724c85aa908dedcc | ≥ 7b4884ca8853a638df0eb5d251d80d67777b8b1a, < ae184024ef31423e5beb44cf4f52999bbcf2fe5b | ≥ 7b4884ca8853a638df0eb5d251d80d67777b8b1a, < 85be7ef8c8e792a414940a38d94565dd48d2f236 | ≥ 7b4884ca8853a638df0eb5d251d80d67777b8b1a, < 06b26e3099207c94b3d1be8565aedc6edc4f0a60 | ≥ 7b4884ca8853a638df0eb5d251d80d67777b8b1a, < 8699358b6ac99b8ccc97ed9e6e3669ef8958ef7b | ≥ 7b4884ca8853a638df0eb5d251d80d67777b8b1a, < 289b58f8ff3198d091074a751d6b8f6827726f3e | ≥ 7b4884ca8853a638df0eb5d251d80d67777b8b1a, < 369bf6e241506583f4ee7593c53b92e5a9f271b4 | ≥ 7b4884ca8853a638df0eb5d251d80d67777b8b1a, < 4a81f78caa53e0633cf311ca1526377d9bff7479 | 2.6.34
- linux_kernel≥ 2.6.34, < 5.4.299 | ≥ 5.5, < 5.10.243 | ≥ 5.11, < 5.15.192 | ≥ 5.16, < 6.1.151 | ≥ 6.2, < 6.6.105 | ≥ 6.7, < 6.12.46 | ≥ 6.13, < 6.16.6 | 6.17:rc1 | 6.17:rc2 | 6.17:rc3 | 6.17:rc4
3 vendors · 152 products
