Security readout for executives and security teams
Plain-English summary
A Linux kernel flaw on IBM Z/s390 systems can make the SCLP interrupt path access the wrong memory page. Successful exploitation requires local, low-privileged access, but the assessed impact includes serious information exposure and system disruption.
Executive priority
Prioritize confirmation and patching for exposed or multi-user s390 environments. Other architectures are not identified as affected by this bundle. Escalate systems processing sensitive data because the assessed confidentiality and availability impacts are high.
Technical view
The SCLP tracing path checks for a missing SCCB after physical-to-virtual translation. When the kernel identity mapping does not begin at zero, that translation cannot produce a NULL address, allowing incorrect access to the identity mapping’s first page. The fix handles NULL before translation.
Likely exposure
Exposure is limited to Linux on the s390 architecture using the affected SCLP code. The bundle identifies several affected kernel versions, but its version data is irregular; confirm exposure using distribution or product advisories and the referenced stable fixes.
Exploitation context
The CVSS 3.1 vector scores this 7.3 and requires local access with low privileges, without user interaction. Potential impacts are high confidentiality and availability loss with limited integrity impact. The bundle marks KEV false and provides no evidence of active exploitation.
Researcher notes
No CWE is assigned in the supplied record. The vulnerable condition depends on a nonzero-start identity mapping and SCCB handling in the SCLP interrupt tracing path. The five stable-tree commits appear to be branch-specific fixes. Public evidence supplied here does not establish exploitability in practice or active attacks.
Mitigation direction
- Install a vendor-supported kernel containing the referenced SCCB address-check fix.
- Prioritize affected multi-user or sensitive s390 systems where local access is available.
- Consult Linux distribution and appliance vendor guidance for exact fixed package versions.
- Reboot into the updated kernel when required by vendor procedures.
Validation and detection
- Inventory Linux hosts and appliances running on s390 or s390x architecture.
- Record each system’s active kernel and vendor package version.
- Compare kernel provenance against vendor advisories and the five referenced stable commits.
- After remediation, verify the running kernel is the updated version.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2025-39694 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.3 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H1.85.5LinuxVulnerability scoring details
Base CVSS 3.1 score
7.3HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/aa5073ac1a2a274812f3b04c278992e68ff67cc7CVE reference, Linux
- https://git.kernel.org/stable/c/86c2825791c3836a8f77a954b9c5ebe6fab410c5CVE reference, Linux
- https://git.kernel.org/stable/c/61605c847599fbfdfafe638607841c7d73719081CVE reference, Linux
- https://git.kernel.org/stable/c/bf83ae3537359af088d6577812ed93113dfbcb7bCVE reference, Linux
- https://git.kernel.org/stable/c/430fa71027b6ac9bb0ce5532b8d0676777d4219aCVE reference, Linux
- https://lists.debian.org/debian-lts-announce/2025/10/msg00008.htmlCVE reference, CVE
- https://cert-portal.siemens.com/productcert/html/ssa-032379.htmlCVE reference, siemens-SADP
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.