Security readout for executives and security teams
Plain-English summary
CVE-2025-39728 is a Linux kernel crash issue in Samsung clock initialization code. On affected systems, it can cause a kernel panic under the documented UBSAN array-bounds condition, impacting availability rather than data confidentiality or integrity. Business urgency is highest for Linux systems using Samsung/Exynos/GS101 clock drivers, especially embedded or ARM64 platforms.
Executive priority
Treat as a scheduled availability-risk patch, not an emergency internet-facing vulnerability. Escalate priority for production devices that depend on Samsung clock initialization or have a history of kernel panics.
Technical view
The Linux kernel fixed an out-of-bounds array access in samsung_clk_init(). The issue occurs because ctx->clk_data.hws is dereferenced before ctx->clk_data.num is set to nr_clks. The CVE is classified as CWE-129 with CVSS 3.1 score 5.5, AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H.
Likely exposure
Exposure appears limited to Linux kernels containing the vulnerable Samsung clock driver path. Systems using Samsung/Exynos/GS101 clock controller initialization are most relevant. The provided data does not show remote exposure or impact to non-Linux products.
Exploitation context
No active exploitation is indicated in the provided sources, and the CVE is not marked KEV. The documented impact is a local availability failure: a kernel panic under UBSAN_ARRAY_BOUNDS=y conditions. No confidentiality or integrity impact is reported.
Researcher notes
The available record describes a bounds-ordering bug fixed by moving num assignment before hws dereference. Evidence supports availability impact only. The source bundle does not provide proof of exploitation, a remote trigger, or product impact beyond Linux kernel Samsung clock code.
Mitigation direction
- Apply Linux stable kernel updates containing the referenced Samsung clock fix.
- For Debian systems, review the linked Debian LTS advisories and update affected kernel packages.
- Prioritize Samsung/Exynos/GS101 ARM64 systems and embedded Linux fleets.
- If updates are unavailable, monitor vendor guidance rather than applying unverified workarounds.
Validation and detection
- Inventory Linux kernel versions across Samsung/Exynos/GS101-related systems.
- Check whether deployed kernels include the referenced stable commits.
- Review boot or kernel logs for UBSAN array-bounds panics in samsung_clk_init().
- Confirm Debian kernel package status against the linked LTS announcements.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-129: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2025-39728 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 5.5 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H1.83.6CISA-ADPVulnerability scoring details
Base CVSS 3.1 score
5.5MediumVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/00307934eb94aaa0a99addfb37b9fe206f945004CVE reference, Linux
- https://git.kernel.org/stable/c/d974e177369c034984cece9d7d4fada9f8b9c740CVE reference, Linux
- https://git.kernel.org/stable/c/0fef48f4a70e45a93e73c39023c3a6ea624714d6CVE reference, Linux
- https://git.kernel.org/stable/c/4d29a6dcb51e346595a15b49693eeb728925ca43CVE reference, Linux
- https://git.kernel.org/stable/c/24307866e0ac0a5ddb462e766ceda5e27a6fbbe3CVE reference, Linux
- https://git.kernel.org/stable/c/a1500b98cd81a32fdfb9bc63c33bb9f0c2a0a1bfCVE reference, Linux
- https://git.kernel.org/stable/c/157de9e48007a20c65d02fc0229a16f38134a72dCVE reference, Linux
- https://git.kernel.org/stable/c/d19d7345a7bcdb083b65568a11b11adffe0687afCVE reference, Linux
- https://lists.debian.org/debian-lts-announce/2025/05/msg00045.htmlCVE reference, CVE
- https://lists.debian.org/debian-lts-announce/2025/05/msg00030.htmlCVE reference, CVE
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.