Security readout for executives and security teams
Plain-English summary
CVE-2025-39903 is a Linux kernel boot-time availability issue. Certain NUMA systems with memory-only nodes can panic during startup because those nodes are not initialized correctly. The business impact is failed boot or service outage on affected kernels and topologies, not data theft or privilege escalation based on the provided sources.
Executive priority
Treat as a moderate availability risk. Prioritize remediation for infrastructure where kernel boot failure would delay recovery, interrupt host capacity, or affect critical virtualized workloads. Lower priority for systems without memory-only NUMA configurations.
Technical view
The Linux kernel of_numa path updates numa_nodes_parsed for CPU nodes but omitted memory-only nodes. Later, free_area_init() may access NODE_DATA() for an uninitialized node, causing a NULL pointer dereference and kernel panic. The source identifies CWE-476, CVSS 5.5, and local availability impact.
Likely exposure
Exposure appears limited to Linux systems using affected kernel builds and NUMA configurations with memory nodes that have no CPUs. The provided reproduction is ARM64 QEMU, but the sources do not prove exposure is limited to virtualized ARM64 only.
Exploitation context
No provided source reports active exploitation, and KEV is false. The described failure is a local boot-time denial of service requiring a specific NUMA memory topology. The sources provide a repro scenario but no evidence of remote exploitation.
Researcher notes
Evidence supports a NULL pointer dereference during early memory initialization. The affected-version data is not fully self-explanatory in the bundle, so rely on Linux stable commits and downstream vendor mappings for exact kernel package status.
Mitigation direction
- Update to a Linux kernel containing one of the referenced stable fixes.
- Use distribution vendor advisories to identify the corrected package for your kernel stream.
- Avoid deploying affected kernels on memory-only NUMA topologies until fixed.
- Prioritize systems where boot failure affects production availability or recovery.
Validation and detection
- Inventory Linux kernel versions and compare them with vendor fixed builds.
- Identify ARM64 or Open Firmware NUMA systems with memory-only nodes.
- Test kernel boot in staging with representative NUMA topology.
- Review boot logs for NODE_DATA, free_area_init, or NULL pointer dereference panics.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-476: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2025-39903 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 5.5 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H1.83.6CISA-ADPVulnerability scoring details
Base CVSS 3.1 score
5.5MediumVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/c2daa6eb4740720b5bd0e06267d7c93a3eed844eCVE reference, Linux
- https://git.kernel.org/stable/c/f3286ad8eeae15fd4bd5c12f9adfe888b26baf62CVE reference, Linux
- https://git.kernel.org/stable/c/ee4d098cbc9160f573b5c1b5a51d6158efdb2896CVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
NULL Pointer Dereference
NULL Pointer Dereference represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.