Security readout for executives and security teams
Plain-English summary
A race condition in the Linux ASUS WMI driver can corrupt kernel memory and crash affected ASUS systems. The supplied CVSS assessment also indicates possible confidentiality and integrity impact, although the source bundle documents crashes rather than demonstrated compromise. Exploitation requires local, low-privileged access.
Executive priority
Treat as an expedited endpoint stability and local privilege-risk issue for affected ASUS Linux fleets, especially shared systems. Internet-facing status alone does not create exposure because the attack vector is local. Prioritize accurate inventory and vendor-supported kernel updates rather than emergency network containment.
Technical view
Concurrent calls to asus_wmi_register_driver() can race during list operations, causing memory corruption and a kernel Oops. Error handling also failed to unregister ACPI lps0 device operations. The kernel fix serializes driver registration and unregistration with a mutex and adds the missing error-path cleanup.
Likely exposure
Exposure is limited to affected Linux kernel versions on some ASUS machines using the asus-wmi path. The supplied version data identifies Linux 6.16 through 6.17-related entries, but its exact range boundaries are ambiguous. Confirm distribution-specific package status before declaring a system vulnerable.
Exploitation context
The CVSS vector describes a local, low-complexity attack requiring low privileges and no user interaction. The supplied sources do not establish active exploitation, and the CVE is not listed as KEV in the bundle. No public exploit evidence is provided.
Researcher notes
CWE-787 and the CVSS 7.8 vector indicate out-of-bounds memory impact with potential kernel-level confidentiality, integrity, and availability consequences. However, the narrative evidence specifically reports racy list corruption and Oops conditions. The source bundle does not demonstrate privilege escalation, reliable exploitation, or remote reachability.
Mitigation direction
- Check Linux distribution advisories for a kernel containing the referenced upstream fixes.
- Prioritize updates for affected ASUS systems allowing untrusted or multi-user local access.
- Apply the vendor-supported kernel update through normal change-management procedures.
- Restrict unnecessary local accounts and workloads until affected systems are updated.
Validation and detection
- Inventory ASUS hardware and record each system's running kernel version.
- Confirm whether the distribution kernel includes either referenced stable fix commit.
- Verify the asus-wmi driver is relevant to each potentially affected system.
- After updating, confirm the intended patched kernel is running.
- Review system logs for prior kernel Oops or memory-corruption symptoms.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-787: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2025-39837 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
2 official scoresWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9LinuxCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9CISA-ADPVulnerability scoring details
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/e7a70326fb26b905cfc8fe2366113aa4394733efCVE reference, Linux
- https://git.kernel.org/stable/c/5549202b9c02c2ecbc8634768a3da8d9e82d548dCVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Out-of-bounds Write
Out-of-bounds Write represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.