CVE-2025-39711
BaseFortify
Publication date: 2025-09-05
Last updated on: 2025-11-25
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| linux | linux_kernel | From 5.15.160 (inc) to 5.16 (inc) |
| linux | linux_kernel | From 5.15.160 (inc) to 5.16 (inc) |
| linux | linux_kernel | From 5.15.160 (inc) to 5.16 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-416 | The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is a use-after-free bug in the Linux kernel's media ivsc driver. Specifically, the ACE and CSI drivers fail to call mei_cldev_disable() in their remove() functions, causing a client to remain in a device's file list after its memory has been freed. When the system shuts down and mei_vsc_remove() runs, it attempts to access this freed memory, leading to a crash.
How can this vulnerability impact me? :
This vulnerability can cause the Linux kernel to crash during system shutdown due to a use-after-free error. This can lead to system instability or unexpected shutdown behavior, potentially causing data loss or service interruption.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by observing kernel crash logs or KASAN (Kernel Address Sanitizer) reports during system shutdown. Specifically, look for KASAN slab-use-after-free errors related to mei_cl_set_disconnected in the kernel logs. You can check the kernel logs using commands like `dmesg | grep -i kasan` or `journalctl -k | grep -i kasan` to find relevant error messages indicating the use-after-free issue in the mei driver.
What immediate steps should I take to mitigate this vulnerability?
The immediate mitigation is to update the Linux kernel to a version where the missing mei_cldev_disable() calls have been added to the ACE and CSI driver's remove() functions. This fix ensures that the mei_cl client is properly removed from the mei_device file_list before its memory is freed, preventing the use-after-free crash at shutdown. Until the update is applied, avoid shutting down or rebooting the system frequently to reduce the chance of triggering the issue.