CVE-2025-39836CWE-787

CVE-2025-39836

High · published September 16, 2025

CVSS v3.1
7.8
EPSS
0%
Percentile
4.2
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

efi: stmm: Fix incorrect buffer allocation method

The communication buffer allocated by setup_mm_hdr() is later on passed

to tee_shm_register_kernel_buf(). The latter expects those buffers to be

contiguous pages, but setup_mm_hdr() just uses kmalloc(). That can cause

various corruptions or BUGs, specifically since commit 9aec2fb0fd5e

("slab: allocate frozen pages"), though it was broken before as well.

Fix this by using alloc_pages_exact() instead of kmalloc().

The record
Technical detail
CVSS v3.1
7.8 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00154 · 4.2th percentile
Weakness
CWE-787 · Out-of-bounds Write
Published
2025-09-16T18:15Z
Affected products (5)
ProductVersionsFixed in
linux/linux_kernel≥ 6.8, < 6.12.456.12.45
linux/linux_kernel≥ 6.13, < 6.16.56.16.5
linux/linux_kernelall versions—
linux/linux_kernelall versions—
linux/linux_kernelall versions—
References (3)
EPSS history
Timeline
  • 16 SEP 13:08Z
    efi: stmm: Fix incorrect buffer allocation method
    cvelistv5