Out-of-Bounds Read in linux (CVE-2025-39901, CVSS 7.1)

Summary

vulnerability in linux (CVE-2025-39901). Confidential information can be exposed externally.

Original description

The description as published by the source.

In the Linux kernel, the following vulnerability has been resolved:

i40e: remove read access to debugfs files

The 'command' and 'netdev_ops' debugfs files are a legacy debugging
interface supported by the i40e driver since its early days by commit
02e9c290814c ("i40e: debugfs interface").

Both of these debugfs files provide a read handler which is mostly useless,
and which is implemented with questionable logic. They both use a static
256 byte buffer which is initialized to the empty string. In the case of
the 'command' file this buffer is literally never used and simply wastes
space. In the case of the 'netdev_ops' file, the last command written is
saved here.

On read, the files contents are presented as the name of the device
followed by a colon and then the contents of their respective static
buffer. For 'command' this will always be ": ". For 'netdev_ops',
this will be ": ". But note the buffer is
shared between all devices operated by this module. At best, it is mostly
meaningless information, and at worse it could be accessed simultaneously
as there doesn't appear to be any locking mechanism.

We have also recently received multiple reports for both read functions
about their use of snprintf and potential overflow that could result in
reading arbitrary kernel memory. For the 'command' file, this is definitely
impossible, since the static buffer is always zero and never written to.
For the 'netdev_ops' file, it does appear to be possible, if the user
carefully crafts…

Source: NIST National Vulnerability Database NVD GitHub Advisory

AI summary

Written by an external AI model and may contain mistakes. Check the original description and references below before acting on it.

A vulnerability tracked as CVE-2025-39901 has been found in linux.
Confidential information can be exposed externally. CVSS score: 7.1/10.
What to do: apply the vendor's official patched release.
If unsure, ask your IT team or search "linux CVE-2025-39901" on the vendor's site.

CVE-2025-39901 (linux) — CWE-125 / CVSS v3 7.1
Attack vector: local / no user interaction
Plan: 1) Audit SBOM/dependencies, 2) Stage→prod upgrade, 3) Add WAF/proxy monitoring on affected endpoints, 4) Hunt IOCs in logs.
Refs: see the GHSA / vendor advisory / patched release linked on this page.

❓ What is the problem

Linuxカーネルのi40eドライバにおけるdebugfsファイルの読み取りアクセスが削除されました。

📍 Affected scope

Linuxカーネルのi40eドライバ内の'command'および'netdev_ops'デバッグファイル。

🔥 Severity

不適切なsnprintfの使用により、カーネルメモリが不正に読み取られる可能性がありました。

🔧 How to fix

snprintfをscnprintfに置き換えるか、静的バッファの使用を廃止し、読み取りアクセスを削除。

🛡️ Workaround

情報なし

🔍 Detection

情報なし

Response actions

Concrete steps and command examples for SOC/SRE teams to execute in order

1
Identify exposure identify
```
grep -r 'linux' . | grep -v node_modules
```
リポジトリと本番環境の依存ファイル (package-lock.json / requirements.txt / go.sum / Gemfile.lock 等) で linux を grep し、稼働しているサービス・バージョンを把握する。
7
Post-deployment verification verify
```
Confirm patched version is live in production
```
パッチ適用後、ステージングで PoC または同等の悪用パターンを再現して脆弱性が閉じたことを確認。本番では Step 3 と同じログクエリでアラート再発が無いか継続監視。

Affected packages

Linux Kernel

[{"type":"ECOSYSTEM","events":[{"introduced":"3.12.0"},{"fixed":"6.1.183"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.2.0"},{"fixed":"6.6.148"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.7.0"},{"fixed":"6.12.46"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.13.0"},{"fixed":"6.16.6"}]}]

Fix status by distribution

Fixed packages published by each distribution for this CVE

BellSoft Alpaquita BELL-CVE-2025-39901 linux-lts
Debian DEBIAN-CVE-2025-39901 linux
Ubuntu UBUNTU-CVE-2025-39901 linux

Out-of-Bounds Read in linux (CVE-2025-39901)