LiveActive security incident?Get immediate response
CVE Record

CVE-2025-39960: gpiolib: acpi: initialize acpi_gpio_info struct

In the Linux kernel, the following vulnerability has been resolved: gpiolib: acpi: initialize acpi_gpio_info struct Since commit 7c010d463372 ("gpiolib: acpi: Make sure we fill struct acpi_gpio_info"), uninitialized acpi_gpio_info struct are passed to __acpi_find_gpio() and later in the call stack info->quirks is used in acpi_populate_gpio_lookup. This breaks the i2c_hid_cpi driver: [ 58.122916] i2c_hid_acpi i2c-UNIW0001:00: HID over i2c has not been provided an Int IRQ [ 58.123097] i2c_hid_acpi i2c-UNIW0001:00: probe with driver i2c_hid_acpi failed with error -22 Fix this by initializing the acpi_gpio_info pass to __acpi_find_gpio()

HighCVSS 7.3Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysishigh

Security readout for executives and security teams

Plain-English summary

A Linux kernel ACPI GPIO flaw can use uninitialized data while configuring hardware. The documented failure prevents an I2C HID device from obtaining an interrupt and loading correctly. The supplied CVSS assessment indicates possible integrity and availability impact, but the sources do not establish remote reachability or active exploitation.

Executive priority

Treat as a high-priority maintenance issue for affected Linux endpoints, especially where HID availability or local integrity matters. It is not an internet-scale emergency based on current evidence. Inventory exposed kernel builds, follow vendor patch guidance, and validate hardware operation after updating.

Technical view

After commit 7c010d463372, some acpi_gpio_info structures passed into __acpi_find_gpio() were not initialized. Later code reads info->quirks in acpi_populate_gpio_lookup, potentially producing incorrect GPIO lookup behavior. The documented manifestation is i2c_hid_acpi probe failure with error -22. The referenced stable-kernel commits initialize the structure.

Likely exposure

Exposure is limited to Linux kernels containing the identified regression and systems exercising affected ACPI GPIO paths, including relevant I2C HID hardware. The supplied version data identifies affected 6.16 and 6.17-series ranges, but its flattened boundaries are ambiguous. Confirm exact status against kernel or distribution advisories.

Exploitation context

The CVSS vector describes local access, low complexity, low privileges, and no user interaction. CISA KEV status is false, and the supplied sources provide no evidence of exploitation in the wild. They document a hardware-driver failure, not a demonstrated attack technique.

Researcher notes

The security consequences beyond incorrect GPIO lookup and driver failure are not demonstrated in the bundle. CVSS claims low confidentiality and high integrity and availability impacts, but no CWE, proof of exploitation, or attack details are supplied. Version interpretation should rely on authoritative distribution mappings because the provided range representation is incomplete.

Mitigation direction

  • Install a vendor-supported kernel incorporating one of the referenced stable fixes.
  • Check distribution advisories for exact fixed package versions before deployment.
  • Prioritize systems using ACPI GPIO and I2C HID devices.
  • Use normal kernel rollback procedures if an update causes hardware regressions.

Validation and detection

  • Record the running kernel version and distribution package revision.
  • Determine whether the kernel contains commit 7c010d463372 and lacks the applicable fix.
  • Review boot logs for i2c_hid_acpi probe failures, missing Int IRQ messages, or error -22.
  • Confirm affected HID devices initialize successfully after remediation.
  • Verify the installed kernel includes the vendor backport or referenced stable commit.
Prepared
Confidence
medium
Sources
4

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2025-39960 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
High
CVSS
7.3 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
3Timeline events
0ADP providers
3Source links

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
7.3CVSS 3.1HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H1.85.5Linux

Vulnerability scoring details

Base CVSS 3.1 score

7.3High
CVSS 3.1 vector shape for CVE-2025-39960Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux7c010d463372140006bf96985a306d6cbfc6e118, 7c010d463372140006bf96985a306d6cbfc6e118unaffected
LinuxLinux6.16, 0, 6.16.9, 6.17affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.