CVE-2025-39701

CVE-2025-39701

High · published September 5, 2025

CVSS v3.1
7.8
EPSS
0%
Percentile
8.1
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

ACPI: pfr_update: Fix the driver update version check

The security-version-number check should be used rather

than the runtime version check for driver updates.

Otherwise, the firmware update would fail when the update binary had

a lower runtime version number than the current one.

[ rjw: Changelog edits ]

The record
Technical detail
CVSS v3.1
7.8 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00189 · 8.1th percentile
Published
2025-09-05T22:15Z
Affected products (7)
ProductVersionsFixed in
linux/linux_kernel≥ 5.17, < 6.1.1496.1.149
linux/linux_kernel≥ 6.2, < 6.6.1036.6.103
linux/linux_kernel≥ 6.7, < 6.12.446.12.44
linux/linux_kernel≥ 6.13, < 6.16.46.16.4
linux/linux_kernelall versions—
linux/linux_kernelall versions—
debian/debian_linuxall versions—
References (7)
EPSS history
Timeline
  • 05 SEP 17:21Z
    ACPI: pfr_update: Fix the driver update version check
    cvelistv5