CVE-2025-39960

CVE-2025-39960

High · published October 9, 2025

CVSS v3.1
7.3
EPSS
0%
Percentile
4.1
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

gpiolib: acpi: initialize acpi_gpio_info struct

Since commit 7c010d463372 ("gpiolib: acpi: Make sure we fill struct

acpi_gpio_info"), uninitialized acpi_gpio_info struct are passed to

__acpi_find_gpio() and later in the call stack info->quirks is used in

acpi_populate_gpio_lookup. This breaks the i2c_hid_cpi driver:

[ 58.122916] i2c_hid_acpi i2c-UNIW0001:00: HID over i2c has not been provided an Int IRQ

[ 58.123097] i2c_hid_acpi i2c-UNIW0001:00: probe with driver i2c_hid_acpi failed with error -22

Fix this by initializing the acpi_gpio_info pass to __acpi_find_gpio()

The record
Technical detail
CVSS v3.1
7.3 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00153 · 4.1th percentile
Published
2025-10-09T17:15Z
Affected products (7)
ProductVersionsFixed in
linux/linux_kernel≥ 6.16, < 6.16.96.16.9
linux/linux_kernelall versions—
linux/linux_kernelall versions—
linux/linux_kernelall versions—
linux/linux_kernelall versions—
linux/linux_kernelall versions—
linux/linux_kernelall versions—
References (2)
EPSS history
Timeline
  • 09 OCT 12:13Z
    gpiolib: acpi: initialize acpi_gpio_info struct
    cvelistv5