{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2025-39817","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","state":"PUBLISHED","assignerShortName":"Linux","dateReserved":"2025-04-16T07:20:57.138Z","datePublished":"2025-09-16T13:00:17.776Z","dateUpdated":"2026-08-05T12:05:23.813Z"},"containers":{"cna":{"providerMetadata":{"orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux","dateUpdated":"2026-08-05T12:05:23.813Z"},"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nefivarfs: Fix slab-out-of-bounds in efivarfs_d_compare\n\nObserved on kernel 6.6 (present on master as well):\n\n  BUG: KASAN: slab-out-of-bounds in memcmp+0x98/0xd0\n  Call trace:\n   kasan_check_range+0xe8/0x190\n   __asan_loadN+0x1c/0x28\n   memcmp+0x98/0xd0\n   efivarfs_d_compare+0x68/0xd8\n   __d_lookup_rcu_op_compare+0x178/0x218\n   __d_lookup_rcu+0x1f8/0x228\n   d_alloc_parallel+0x150/0x648\n   lookup_open.isra.0+0x5f0/0x8d0\n   open_last_lookups+0x264/0x828\n   path_openat+0x130/0x3f8\n   do_filp_open+0x114/0x248\n   do_sys_openat2+0x340/0x3c0\n   __arm64_sys_openat+0x120/0x1a0\n\nIf dentry->d_name.len < EFI_VARIABLE_GUID_LEN , 'guid' can become\nnegative, leadings to oob. The issue can be triggered by parallel\nlookups using invalid filename:\n\n  T1\t\t\tT2\n  lookup_open\n   ->lookup\n    simple_lookup\n     d_add\n     // invalid dentry is added to hash list\n\n\t\t\tlookup_open\n\t\t\t d_alloc_parallel\n\t\t\t  __d_lookup_rcu\n\t\t\t   __d_lookup_rcu_op_compare\n\t\t\t    hlist_bl_for_each_entry_rcu\n\t\t\t    // invalid dentry can be retrieved\n\t\t\t     ->d_compare\n\t\t\t      efivarfs_d_compare\n\t\t\t      // oob\n\nFix it by checking 'guid' before cmp."}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H","baseScore":7.1,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:L - The vulnerable `efivarfs_d_compare()` is reached only through local path-lookup syscalls (`openat`/`stat`) against the efivarfs mount at /sys/firmware/efi/efivars. There is no network or remote-peer input path into the dcache lookup for this filesystem.\nAC:L - `efivarfs_d_hash()` makes every name shorter than 36 bytes hash to the same value, so the attacker deterministically constructs the bucket collision and length match rather than guessing them, and both sides of the parallel-lookup race are attacker threads that can retry in a tight loop indefinitely. No condition outside the attacker's control is required.\nPR:L - The efivarfs root directory is mode 0755 and lookup requires only MAY_EXEC, so any unprivileged local user can issue the two concurrent `openat()` calls; `->lookup` is `simple_lookup` with no name validation and no write permission needed. No capability, and no root, is involved.\nUI:N - The attacker drives both racing lookups themselves with no victim participation. efivarfs being mounted is a default-deployment property of UEFI systems (systemd mounts it at boot), not an action a user must be tricked into performing.\nS:U - The out-of-bounds read stays within kernel slab memory under the same kernel security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - The negative `guid` is promoted to a ~2^64 `size_t`, giving a length-unbounded read that walks past the `dentry_cache` object into arbitrary adjacent kernel heap memory, and the attacker controls the comparison bytes on both sides so the early-exit point of `memcmp` acts as an oracle on that memory. Per kernel guidance an unbounded OOB read scores High.\nI:N - `efivarfs_d_compare()` performs only `memcmp`/`strncasecmp` reads and writes nothing; a false dentry match that could redirect a lookup to the wrong EFI variable would require ~2^64 consecutive matching bytes, which faults long before it could occur.\nA:H - The KASAN trace in the fix commit documents a slab-out-of-bounds abort, and the unbounded read readily runs off the slab page into unmapped memory, producing an oops or panic (and an immediate panic under KASAN/panic_on_oops). The attacker can retrigger it at will from an unprivileged loop."}]}],"affected":[{"product":"Linux","vendor":"Linux","defaultStatus":"unaffected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["fs/efivarfs/super.c"],"versions":[{"version":"da27a24383b2b10bf6ebd0db29b325548aafecb4","lessThan":"0f63fbabeaaaaaaf5b742a2f4c1b4590d50bf1f6","status":"affected","versionType":"git"},{"version":"da27a24383b2b10bf6ebd0db29b325548aafecb4","lessThan":"794399019301944fd6d2e0d7a51b3327e26c410e","status":"affected","versionType":"git"},{"version":"da27a24383b2b10bf6ebd0db29b325548aafecb4","lessThan":"568e7761279b99c6daa3002290fd6d8047ddb6d2","status":"affected","versionType":"git"},{"version":"da27a24383b2b10bf6ebd0db29b325548aafecb4","lessThan":"d7f5e35e70507d10cbaff5f9e194ed54c4ee14f7","status":"affected","versionType":"git"},{"version":"da27a24383b2b10bf6ebd0db29b325548aafecb4","lessThan":"925599eba46045930b850a98ae594d2e3028ac40","status":"affected","versionType":"git"},{"version":"da27a24383b2b10bf6ebd0db29b325548aafecb4","lessThan":"c2925cd6207079c3f4d040d082515db78d63afbf","status":"affected","versionType":"git"},{"version":"da27a24383b2b10bf6ebd0db29b325548aafecb4","lessThan":"71581a82f38e5a4d807d71fc1bb59aead80ccf95","status":"affected","versionType":"git"},{"version":"da27a24383b2b10bf6ebd0db29b325548aafecb4","lessThan":"a6358f8cf64850f3f27857b8ed8c1b08cfc4685c","status":"affected","versionType":"git"},{"version":"688289c4b745c018b3449b4b4c5a2030083c8eaf","status":"affected","versionType":"git"},{"version":"3.8.2","lessThan":"3.9","status":"affected","versionType":"semver"}]},{"product":"Linux","vendor":"Linux","defaultStatus":"affected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["fs/efivarfs/super.c"],"versions":[{"version":"3.9","status":"affected"},{"version":"0","lessThan":"3.9","status":"unaffected","versionType":"semver"},{"version":"5.4.298","lessThanOrEqual":"5.4.*","status":"unaffected","versionType":"semver"},{"version":"5.10.242","lessThanOrEqual":"5.10.*","status":"unaffected","versionType":"semver"},{"version":"5.15.191","lessThanOrEqual":"5.15.*","status":"unaffected","versionType":"semver"},{"version":"6.1.150","lessThanOrEqual":"6.1.*","status":"unaffected","versionType":"semver"},{"version":"6.6.104","lessThanOrEqual":"6.6.*","status":"unaffected","versionType":"semver"},{"version":"6.12.45","lessThanOrEqual":"6.12.*","status":"unaffected","versionType":"semver"},{"version":"6.16.5","lessThanOrEqual":"6.16.*","status":"unaffected","versionType":"semver"},{"version":"6.17","lessThanOrEqual":"*","status":"unaffected","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.9","versionEndExcluding":"5.4.298"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.9","versionEndExcluding":"5.10.242"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.9","versionEndExcluding":"5.15.191"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.9","versionEndExcluding":"6.1.150"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.9","versionEndExcluding":"6.6.104"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.9","versionEndExcluding":"6.12.45"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.9","versionEndExcluding":"6.16.5"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.9","versionEndExcluding":"6.17"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.8.2"}]}]}],"references":[{"url":"https://git.kernel.org/stable/c/0f63fbabeaaaaaaf5b742a2f4c1b4590d50bf1f6"},{"url":"https://git.kernel.org/stable/c/794399019301944fd6d2e0d7a51b3327e26c410e"},{"url":"https://git.kernel.org/stable/c/568e7761279b99c6daa3002290fd6d8047ddb6d2"},{"url":"https://git.kernel.org/stable/c/d7f5e35e70507d10cbaff5f9e194ed54c4ee14f7"},{"url":"https://git.kernel.org/stable/c/925599eba46045930b850a98ae594d2e3028ac40"},{"url":"https://git.kernel.org/stable/c/c2925cd6207079c3f4d040d082515db78d63afbf"},{"url":"https://git.kernel.org/stable/c/71581a82f38e5a4d807d71fc1bb59aead80ccf95"},{"url":"https://git.kernel.org/stable/c/a6358f8cf64850f3f27857b8ed8c1b08cfc4685c"}],"title":"efivarfs: Fix slab-out-of-bounds in efivarfs_d_compare","x_generator":{"engine":"bippy-1.2.0"}},"adp":[{"title":"CVE Program Container","references":[{"url":"https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html"},{"url":"https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html"}],"providerMetadata":{"orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE","dateUpdated":"2025-11-03T17:43:40.463Z"}},{"x_adpType":"supplier","providerMetadata":{"orgId":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","shortName":"siemens-SADP","dateUpdated":"2026-05-12T12:07:15.910Z"},"affected":[{"vendor":"Siemens","product":"SIMATIC CN 4100","versions":[{"status":"affected","version":"0","lessThan":"V5.0","versionType":"custom"}],"defaultStatus":"unknown"}],"references":[{"url":"https://cert-portal.siemens.com/productcert/html/ssa-032379.html"}]},{"metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2025-39817","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-06-10T20:40:28.646943Z"}}}],"title":"CISA ADP Vulnrichment","providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-06-11T18:44:01.643Z"}}]}}