Security readout for executives and security teams
Plain-English summary
A flaw in Linux User Mode Linux virtual-device handling can leave software treating a failed device registration as successful. This may cause use-after-free memory access, potentially crashing the environment or compromising confidentiality and integrity. Exploitation requires local, low-privileged access and the affected virtio_uml path.
Executive priority
Prioritize timely remediation where User Mode Linux supports untrusted or multi-user workloads because successful abuse could affect all three security objectives. For other systems, first confirm whether virtio_uml is present and reachable. No evidence in the supplied sources supports emergency treatment for active exploitation.
Technical view
In virtio_uml_probe(), a register_virtio_device() failure incorrectly leaves vu_dev->registered set, permitting later operations on released device memory. The CVSS 3.1 score is 7.8 with local attack vector, low complexity, low privileges, no user interaction, and potentially high confidentiality, integrity, and availability impact.
Likely exposure
Exposure appears limited to Linux deployments using User Mode Linux and the virtio_uml device path. The supplied version data is ambiguous and contains duplicate commit identifiers, so organizations should not infer applicability from version numbers alone. Conventional Linux hosts not using this subsystem may have reduced practical exposure.
Exploitation context
The bundle does not identify public exploitation, proof-of-concept availability, or inclusion in CISA KEV. The vulnerable condition involves a device-registration failure and requires local access according to the supplied CVSS vector. Treat active exploitation as unconfirmed.
Researcher notes
The record describes a use-after-free possibility following register_virtio_device() failure, but supplies no CWE, exploit evidence, reproduction details, or reliable distribution-package mapping. Multiple stable commits are referenced, apparently representing branch-specific fixes. The affected-version list is difficult to interpret and should be reconciled against upstream or distributor guidance.
Mitigation direction
- Obtain a vendor-supported kernel containing the applicable stable fix.
- Check distribution guidance for backported fixes and exact package versions.
- Prioritize systems that actively use User Mode Linux and virtio_uml.
- Restrict untrusted local access until affected systems are remediated.
Validation and detection
- Inventory kernels and identify systems configured for User Mode Linux and virtio_uml.
- Verify fix inclusion through vendor advisories or kernel commit provenance.
- Confirm deployed kernels match remediated packages after maintenance.
- Review relevant crash records for failures around virtio device registration.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2025-39951 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9LinuxVulnerability scoring details
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/14c231959a16ca41bfdcaede72483362a8c645d7CVE reference, Linux
- https://git.kernel.org/stable/c/5e94e44c9cb30d7a383d8ac227f24a8c9326b770CVE reference, Linux
- https://git.kernel.org/stable/c/aaf900a83508c8cd5cdf765e7749f9076196ec7fCVE reference, Linux
- https://git.kernel.org/stable/c/4f364023ddcfe83f7073b973a9cb98584b7f2a46CVE reference, Linux
- https://git.kernel.org/stable/c/00e98b5a69034b251bb36dc6e7123d7648e218e4CVE reference, Linux
- https://git.kernel.org/stable/c/c2ff91255e0157b356cff115d8dc3eeb5162edf2CVE reference, Linux
- https://git.kernel.org/stable/c/7ebf70cf181651fe3f2e44e95e7e5073d594c9c0CVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.