Security readout for executives and security teams
Plain-English summary
A Linux kernel memory-allocation flaw can trigger memory corruption or kernel failures when the EFI STMM communication path is used. The supplied CVSS rates potential confidentiality, integrity, and availability impacts as high, but exploitation requires local, low-privileged access.
Executive priority
Prioritize remediation on systems that use EFI STMM and permit local user access. Treat this as a high-impact kernel issue, but not as an internet-wide emergency because the supplied evidence indicates local access and no active exploitation.
Technical view
setup_mm_hdr() allocated a communication buffer with kmalloc(), while tee_shm_register_kernel_buf() requires contiguous pages. This mismatch can cause corruption or kernel BUG conditions. The documented correction replaces kmalloc() with alloc_pages_exact().
Likely exposure
Exposure is limited to Linux systems running an affected kernel and exercising the EFI STMM code path. The bundle identifies 6.8, 6.12.45, 6.16.5, and 6.17, but does not provide sufficiently clear version ranges for broader conclusions.
Exploitation context
The CVSS vector indicates local access, low privileges, low complexity, and no user interaction. The bundle reports no KEV listing and provides no evidence of active exploitation or a public exploit.
Researcher notes
The corruption reportedly became especially apparent after commit 9aec2fb0fd5e, although the allocation contract was already broken. The supplied version data is ambiguous and includes an unexplained “0,” so distribution-specific advisories are necessary for reliable package-level exposure decisions.
Mitigation direction
- Apply a vendor-supported kernel update containing the applicable cited stable fix.
- Prioritize systems where the EFI STMM communication path is enabled or used.
- Consult distribution or appliance vendor guidance for precise affected and corrected versions.
- Restrict local account access until affected systems are updated.
Validation and detection
- Inventory installed kernel versions across Linux systems.
- Confirm whether each system uses the EFI STMM code path.
- Map vendor kernel packages to the cited upstream stable fixes.
- After updating, verify the running kernel matches the installed corrected package.
- Review kernel logs for unexplained corruption or BUG events without treating them as proof of exploitation.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-787: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2025-39836 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
2 official scoresWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9LinuxCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9CISA-ADPVulnerability scoring details
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/77ff27ff0e4529a003c8a1c2492c111968c378d3CVE reference, Linux
- https://git.kernel.org/stable/c/630c0e6064daf84f17aad1a7d9ca76b562e3fe47CVE reference, Linux
- https://git.kernel.org/stable/c/c5e81e672699e0c5557b2b755cc8f7a69aa92bffCVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Out-of-bounds Write
Out-of-bounds Write represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.