Vulnerability Details CVE-2025-39939
In the Linux kernel, the following vulnerability has been resolved:
iommu/s390: Fix memory corruption when using identity domain
zpci_get_iommu_ctrs() returns counter information to be reported as part
of device statistics; these counters are stored as part of the s390_domain.
The problem, however, is that the identity domain is not backed by an
s390_domain and so the conversion via to_s390_domain() yields a bad address
that is zero'd initially and read on-demand later via a sysfs read.
These counters aren't necessary for the identity domain; just return NULL
in this case.
This issue was discovered via KASAN with reports that look like:
BUG: KASAN: global-out-of-bounds in zpci_fmb_enable_device
when using the identity domain for a device on s390.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.001
EPSS Ranking 3.3%
CVSS Severity
CVSS v3 Score 7.8
References
Products affected by CVE-2025-39939
-
cpe:2.3:o:linux:linux_kernel:6.15
-
cpe:2.3:o:linux:linux_kernel:6.15.1
-
cpe:2.3:o:linux:linux_kernel:6.15.10
-
cpe:2.3:o:linux:linux_kernel:6.15.11
-
cpe:2.3:o:linux:linux_kernel:6.15.2
-
cpe:2.3:o:linux:linux_kernel:6.15.3
-
cpe:2.3:o:linux:linux_kernel:6.15.4
-
cpe:2.3:o:linux:linux_kernel:6.15.5
-
cpe:2.3:o:linux:linux_kernel:6.15.6
-
cpe:2.3:o:linux:linux_kernel:6.15.7
-
cpe:2.3:o:linux:linux_kernel:6.15.8
-
cpe:2.3:o:linux:linux_kernel:6.15.9
-
cpe:2.3:o:linux:linux_kernel:6.16
-
cpe:2.3:o:linux:linux_kernel:6.16.1
-
cpe:2.3:o:linux:linux_kernel:6.16.2
-
cpe:2.3:o:linux:linux_kernel:6.16.3
-
cpe:2.3:o:linux:linux_kernel:6.16.4
-
cpe:2.3:o:linux:linux_kernel:6.16.5
-
cpe:2.3:o:linux:linux_kernel:6.16.6
-
cpe:2.3:o:linux:linux_kernel:6.16.7
-
cpe:2.3:o:linux:linux_kernel:6.16.8
-
cpe:2.3:o:linux:linux_kernel:6.17