{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2025-39694","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","state":"PUBLISHED","assignerShortName":"Linux","dateReserved":"2025-04-16T07:20:57.114Z","datePublished":"2025-09-05T17:21:00.361Z","dateUpdated":"2026-08-05T12:04:36.685Z"},"containers":{"cna":{"providerMetadata":{"orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux","dateUpdated":"2026-08-05T12:04:36.685Z"},"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ns390/sclp: Fix SCCB present check\n\nTracing code called by the SCLP interrupt handler contains early exits\nif the SCCB address associated with an interrupt is NULL. This check is\nperformed after physical to virtual address translation.\n\nIf the kernel identity mapping does not start at address zero, the\nresulting virtual address is never zero, so that the NULL checks won't\nwork. Subsequently this may result in incorrect accesses to the first\npage of the identity mapping.\n\nFix this by introducing a function that handles the NULL case before\naddress translation."}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H","baseScore":7.3,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:L - The defect is in the s390 SCLP driver's external-interrupt handler and is reached only from the local machine's service-processor/hypervisor interface, with local paths (SCLP console/tty, /dev/hmcdrv HMC transfers, config-change notifications) eliciting the event-pending interrupts that carry `finished_sccb == 0`. There is no network or adjacent-network attack surface.\nAC:L - On an affected kernel with a non-zero identity base (the default on v6.10–v6.11-rc4 with KASLR, and selectable thereafter), every event-pending SCLP interrupt deterministically defeats the NULL guards — nothing depends on memory layout, timing, or any condition outside the attacker's influence. No race must be won and no rare precondition beyond kernel configuration is involved.\nPR:L - No capability check, credential, or privileged gate exists anywhere on the path — the faulty dereference occurs unconditionally in the interrupt handler during normal system operation, so an ordinary local account on the affected LPAR/guest suffices to be present when it fires and to drive SCLP event traffic. Real root in the initial namespace is not required for the bug to be exercised.\nUI:N - The SCLP external interrupt is delivered asynchronously by the machine and the bad dereference happens entirely inside the interrupt handler. No victim must open a file, mount anything, or take any action.\nS:U - The kernel reads the wrong kernel-side address and writes into its own debug trace areas; the impact is confined to the kernel's own security authority. No hypervisor, IOMMU, or sandbox boundary is crossed.\nC:H - `sclp_trace_bin()` uses a length field read from the wrong page, so `debug_event_common()` loops and copies up to 65535 bytes of out-of-bounds kernel memory — starting at the running CPU's lowcore, which holds `current_task`, kernel/async/restart stack pointers, ASCEs, per-CPU offset and saved PSWs/registers — into the `sclp`/`sclp_err` trace areas and any resulting dump. This is a large unbounded-in-practice kernel read that defeats KASLR and exposes pointers, far beyond a \"few bytes\" bounded leak.\nI:L - There is no arbitrary or out-of-bounds write primitive; the corruption is confined to kernel diagnostic state — thousands of bogus entries per interrupt wipe the entire SCLP error-trace ring buffer and every affected interrupt is falsely flagged as an error, destroying legitimate service-call diagnostic history. That is real but limited modification of kernel data.\nA:H - Once the companion change `93f616ff870a1f` leaves the first two pages of the identity mapping unmapped, `__va(0)` becomes an invalid address and the deref raises an addressing exception inside an external-interrupt handler holding `sclp_lock`, producing a kernel oops/panic; even where the page is mapped, the garbage `sccb->length` forces up to ~4096 `debug_event()` iterations per interrupt under a raw spinlock in IRQ context, adding sustained interrupt-latency degradation on the console path."}]}],"affected":[{"product":"Linux","vendor":"Linux","defaultStatus":"unaffected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/s390/char/sclp.c"],"versions":[{"version":"ada1da31ce34248bc97ca8f801f2cf6efa378a81","lessThan":"aa5073ac1a2a274812f3b04c278992e68ff67cc7","status":"affected","versionType":"git"},{"version":"ada1da31ce34248bc97ca8f801f2cf6efa378a81","lessThan":"86c2825791c3836a8f77a954b9c5ebe6fab410c5","status":"affected","versionType":"git"},{"version":"ada1da31ce34248bc97ca8f801f2cf6efa378a81","lessThan":"61605c847599fbfdfafe638607841c7d73719081","status":"affected","versionType":"git"},{"version":"ada1da31ce34248bc97ca8f801f2cf6efa378a81","lessThan":"bf83ae3537359af088d6577812ed93113dfbcb7b","status":"affected","versionType":"git"},{"version":"ada1da31ce34248bc97ca8f801f2cf6efa378a81","lessThan":"430fa71027b6ac9bb0ce5532b8d0676777d4219a","status":"affected","versionType":"git"}]},{"product":"Linux","vendor":"Linux","defaultStatus":"affected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/s390/char/sclp.c"],"versions":[{"version":"5.16","status":"affected"},{"version":"0","lessThan":"5.16","status":"unaffected","versionType":"semver"},{"version":"6.1.149","lessThanOrEqual":"6.1.*","status":"unaffected","versionType":"semver"},{"version":"6.6.103","lessThanOrEqual":"6.6.*","status":"unaffected","versionType":"semver"},{"version":"6.12.44","lessThanOrEqual":"6.12.*","status":"unaffected","versionType":"semver"},{"version":"6.16.4","lessThanOrEqual":"6.16.*","status":"unaffected","versionType":"semver"},{"version":"6.17","lessThanOrEqual":"*","status":"unaffected","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.16","versionEndExcluding":"6.1.149"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.16","versionEndExcluding":"6.6.103"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.16","versionEndExcluding":"6.12.44"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.16","versionEndExcluding":"6.16.4"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.16","versionEndExcluding":"6.17"}]}]}],"references":[{"url":"https://git.kernel.org/stable/c/aa5073ac1a2a274812f3b04c278992e68ff67cc7"},{"url":"https://git.kernel.org/stable/c/86c2825791c3836a8f77a954b9c5ebe6fab410c5"},{"url":"https://git.kernel.org/stable/c/61605c847599fbfdfafe638607841c7d73719081"},{"url":"https://git.kernel.org/stable/c/bf83ae3537359af088d6577812ed93113dfbcb7b"},{"url":"https://git.kernel.org/stable/c/430fa71027b6ac9bb0ce5532b8d0676777d4219a"}],"title":"s390/sclp: Fix SCCB present check","x_generator":{"engine":"bippy-1.2.0"}},"adp":[{"title":"CVE Program Container","references":[{"url":"https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html"}],"providerMetadata":{"orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE","dateUpdated":"2025-11-03T17:42:26.884Z"}},{"x_adpType":"supplier","providerMetadata":{"orgId":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","shortName":"siemens-SADP","dateUpdated":"2026-05-12T12:06:20.806Z"},"affected":[{"vendor":"Siemens","product":"SIMATIC CN 4100","versions":[{"status":"affected","version":"0","lessThan":"V5.0","versionType":"custom"}],"defaultStatus":"unknown"}],"references":[{"url":"https://cert-portal.siemens.com/productcert/html/ssa-032379.html"}]}]}}