CVE-2025-39840 (GCVE-0-2025-39840)
Vulnerability from cvelistv5
Published
2025-09-19 15:26
Modified
2026-08-05 12:05
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
audit: fix out-of-bounds read in audit_compare_dname_path()
When a watch on dir=/ is combined with an fsnotify event for a
single-character name directly under / (e.g., creating /a), an
out-of-bounds read can occur in audit_compare_dname_path().
The helper parent_len() returns 1 for "/". In audit_compare_dname_path(),
when parentlen equals the full path length (1), the code sets p = path + 1
and pathlen = 1 - 1 = 0. The subsequent loop then dereferences
p[pathlen - 1] (i.e., p[-1]), causing an out-of-bounds read.
Fix this by adding a pathlen > 0 check to the while loop condition
to prevent the out-of-bounds access.
[PM: subject tweak, sign-off email fixes]
References
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2025-39840",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-01-14T19:20:33.496174Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-125",
"description": "CWE-125 Out-of-bounds Read",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-01-14T19:23:12.172Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"kernel/auditfilter.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "9735a9dcc307427e7d6336c54171682f1bac9789",
"status": "affected",
"version": "e92eebb0d6116f942ab25dfb1a41905aa59472a8",
"versionType": "git"
},
{
"lessThan": "4540f1d23e7f387880ce46d11b5cd3f27248bf8d",
"status": "affected",
"version": "e92eebb0d6116f942ab25dfb1a41905aa59472a8",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"kernel/auditfilter.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.14"
},
{
"lessThan": "6.14",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.16.*",
"status": "unaffected",
"version": "6.16.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.17",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.16.6",
"versionStartIncluding": "6.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.17",
"versionStartIncluding": "6.14",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\naudit: fix out-of-bounds read in audit_compare_dname_path()\n\nWhen a watch on dir=/ is combined with an fsnotify event for a\nsingle-character name directly under / (e.g., creating /a), an\nout-of-bounds read can occur in audit_compare_dname_path().\n\nThe helper parent_len() returns 1 for \"/\". In audit_compare_dname_path(),\nwhen parentlen equals the full path length (1), the code sets p = path + 1\nand pathlen = 1 - 1 = 0. The subsequent loop then dereferences\np[pathlen - 1] (i.e., p[-1]), causing an out-of-bounds read.\n\nFix this by adding a pathlen \u003e 0 check to the while loop condition\nto prevent the out-of-bounds access.\n\n[PM: subject tweak, sign-off email fixes]"
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The vulnerable code is reached only through the syscall audit context (`__audit_getname`/`__audit_inode_child`) or an fsnotify event on a locally-installed audit watch, both of which require issuing local syscalls such as symlink()/mkdir()/rename(). No network-facing kernel service (nfsd/ksmbd) builds audit name entries via getname(), so there is no remote path to the defect.\nAC:L - The attacker fully controls both inputs \u2014 an all-slash pathname argument and the basename of the created child \u2014 so the backwards walk past the start of the buffer is triggered deterministically on every attempt, with no race to win and no timing dependency. Padding the slash string to \u2265EMBEDDED_NAME_MAX deterministically forces the string into a page-aligned names_cachep object, so even the page-boundary read is attacker-arranged.\nPR:L - Any unprivileged local user can call symlink(\"///\u2026\", \"/tmp/x\") in a world-writable directory; no capability, namespace trick, or audit privilege is needed, and the AUDIT_TYPE_UNKNOWN found_child branch bypasses the ino/dev ownership check entirely. The only precondition is a system-wide audit ruleset installed by the administrator, which is an environmental condition rather than an attacker privilege.\nUI:N - The attacking process performs the whole sequence itself in a single syscall; no victim has to mount a filesystem, open a file, or take any other action.\nS:U - The out-of-bounds read occurs in kernel heap memory and both the flaw and its consequences stay within the kernel\u0027s own security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - This is an out-of-bounds read that is not bounded to a few bytes \u2014 the loop keeps decrementing and dereferencing backwards for as long as the preceding kernel memory contains 0x2f bytes, so an attacker who sprays \u0027/\u0027 bytes into the heap can extend the walk across adjacent slab objects and pages, touching arbitrary kernel memory beyond the allocation.\nI:N - The defect performs only reads; `pathlen` becomes negative so the comparison always returns \"no match\" and `memcmp()` is unreachable, leaving no memory write, no control-flow influence, and no change to the audit records that would be emitted.\nA:H - With a slash string long enough to occupy a page-aligned 4096-byte names_cachep object, the walk immediately dereferences the byte before a page boundary and can continue across pages, producing a kernel oops on an unmapped/guard page under KFENCE, DEBUG_PAGEALLOC, or a direct-map hole, and a fatal KASAN report on hardened kernels; it is repeatable at will by an unprivileged user."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:05:33.644Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/9735a9dcc307427e7d6336c54171682f1bac9789"
},
{
"url": "https://git.kernel.org/stable/c/4540f1d23e7f387880ce46d11b5cd3f27248bf8d"
}
],
"title": "audit: fix out-of-bounds read in audit_compare_dname_path()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2025-39840",
"datePublished": "2025-09-19T15:26:15.596Z",
"dateReserved": "2025-04-16T07:20:57.141Z",
"dateUpdated": "2026-08-05T12:05:33.644Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"vulnerability-lookup:meta": {
"vulnrichment": {
"containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 7.1, \"attackVector\": \"LOCAL\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H\", \"integrityImpact\": \"NONE\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"HIGH\"}}, {\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2025-39840\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-01-14T19:20:33.496174Z\"}}}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-125\", \"description\": \"CWE-125 Out-of-bounds Read\"}]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-01-14T19:20:28.546Z\"}}], \"cna\": {\"title\": \"audit: fix out-of-bounds read in audit_compare_dname_path()\", \"metrics\": [{\"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 7.1, \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"AV:L - The vulnerable code is reached only through the syscall audit context (`__audit_getname`/`__audit_inode_child`) or an fsnotify event on a locally-installed audit watch, both of which require issuing local syscalls such as symlink()/mkdir()/rename(). No network-facing kernel service (nfsd/ksmbd) builds audit name entries via getname(), so there is no remote path to the defect.\\nAC:L - The attacker fully controls both inputs \\u2014 an all-slash pathname argument and the basename of the created child \\u2014 so the backwards walk past the start of the buffer is triggered deterministically on every attempt, with no race to win and no timing dependency. Padding the slash string to \\u2265EMBEDDED_NAME_MAX deterministically forces the string into a page-aligned names_cachep object, so even the page-boundary read is attacker-arranged.\\nPR:L - Any unprivileged local user can call symlink(\\\"///\\u2026\\\", \\\"/tmp/x\\\") in a world-writable directory; no capability, namespace trick, or audit privilege is needed, and the AUDIT_TYPE_UNKNOWN found_child branch bypasses the ino/dev ownership check entirely. The only precondition is a system-wide audit ruleset installed by the administrator, which is an environmental condition rather than an attacker privilege.\\nUI:N - The attacking process performs the whole sequence itself in a single syscall; no victim has to mount a filesystem, open a file, or take any other action.\\nS:U - The out-of-bounds read occurs in kernel heap memory and both the flaw and its consequences stay within the kernel\u0027s own security authority; no VM, IOMMU, or sandbox boundary is crossed.\\nC:H - This is an out-of-bounds read that is not bounded to a few bytes \\u2014 the loop keeps decrementing and dereferencing backwards for as long as the preceding kernel memory contains 0x2f bytes, so an attacker who sprays \u0027/\u0027 bytes into the heap can extend the walk across adjacent slab objects and pages, touching arbitrary kernel memory beyond the allocation.\\nI:N - The defect performs only reads; `pathlen` becomes negative so the comparison always returns \\\"no match\\\" and `memcmp()` is unreachable, leaving no memory write, no control-flow influence, and no change to the audit records that would be emitted.\\nA:H - With a slash string long enough to occupy a page-aligned 4096-byte names_cachep object, the walk immediately dereferences the byte before a page boundary and can continue across pages, producing a kernel oops on an unmapped/guard page under KFENCE, DEBUG_PAGEALLOC, or a direct-map hole, and a fatal KASAN report on hardened kernels; it is repeatable at will by an unprivileged user.\"}]}], \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"e92eebb0d6116f942ab25dfb1a41905aa59472a8\", \"lessThan\": \"9735a9dcc307427e7d6336c54171682f1bac9789\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"e92eebb0d6116f942ab25dfb1a41905aa59472a8\", \"lessThan\": \"4540f1d23e7f387880ce46d11b5cd3f27248bf8d\", \"versionType\": \"git\"}], \"programFiles\": [\"kernel/auditfilter.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"6.14\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"6.14\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"6.16.6\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.16.*\"}, {\"status\": \"unaffected\", \"version\": \"6.17\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"kernel/auditfilter.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/9735a9dcc307427e7d6336c54171682f1bac9789\"}, {\"url\": \"https://git.kernel.org/stable/c/4540f1d23e7f387880ce46d11b5cd3f27248bf8d\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\naudit: fix out-of-bounds read in audit_compare_dname_path()\\n\\nWhen a watch on dir=/ is combined with an fsnotify event for a\\nsingle-character name directly under / (e.g., creating /a), an\\nout-of-bounds read can occur in audit_compare_dname_path().\\n\\nThe helper parent_len() returns 1 for \\\"/\\\". In audit_compare_dname_path(),\\nwhen parentlen equals the full path length (1), the code sets p = path + 1\\nand pathlen = 1 - 1 = 0. The subsequent loop then dereferences\\np[pathlen - 1] (i.e., p[-1]), causing an out-of-bounds read.\\n\\nFix this by adding a pathlen \u003e 0 check to the while loop condition\\nto prevent the out-of-bounds access.\\n\\n[PM: subject tweak, sign-off email fixes]\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.16.6\", \"versionStartIncluding\": \"6.14\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.17\", \"versionStartIncluding\": \"6.14\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-08-05T12:05:33.644Z\"}}}",
"cveMetadata": "{\"cveId\": \"CVE-2025-39840\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-05T12:05:33.644Z\", \"dateReserved\": \"2025-04-16T07:20:57.141Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2025-09-19T15:26:15.596Z\", \"assignerShortName\": \"Linux\"}",
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
}
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.
Loading…
Loading…