CVE-2025-39728 — Improper Validation of Array Index in Linux

CWE-129 — Improper Validation of Array Index65 documents7 sources
Severity
5.5MEDIUMNVD
OSV8.8OSV7.1OSV5.9OSV4.4
EPSS
0.1%
top 71.14%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
6
LinuxLinux KernelDebian Linux+3 more
Timeline
PublishedApr 18
Latest updateJan 9

Description

In the Linux kernel, the following vulnerability has been resolved: clk: samsung: Fix UBSAN panic in samsung_clk_init() With UBSAN_ARRAY_BOUNDS=y, I'm hitting the below panic due to dereferencing `ctx->clk_data.hws` before setting `ctx->clk_data.num = nr_clks`. Move that up to fix the crash. UBSAN: array index out of bounds: 00000000f2005512 [#1] PREEMPT SMP Call trace: samsung_clk_init+0x110/0x124 (P) samsung_clk_init+0x48/0x124 (L) samsung_cmu_register_one+0x3c/0xa0 exynos_arm64_register_c…

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HExploitability: 1.8 | Impact: 3.6

Affected Packages8 packages

▶NVDlinux/linux_kernel5.5 — 5.10.236+6
▶Debianlinux/linux_kernel< 5.10.237-1+3
▶Ubuntulinux/linux_kernel< 5.15.0-142.152+2
▶CVEListV5linux/linuxe620a1e061c4738e26c3edf2abaae7842532cd80 — 00307934eb94aaa0a99addfb37b9fe206f945004+8

Patches

Patch: git.kernel.org ↗Patch: git.kernel.org ↗Patch: git.kernel.org ↗

🔴Vulnerability Details

32
OSV
linux-azure-nvidia vulnerabilities↗2026-01-09
▶
OSV
linux-azure-fips vulnerabilities↗2025-12-17
▶
OSV
linux-raspi vulnerabilities↗2025-11-25
▶
OSV
linux-raspi-realtime vulnerabilities↗2025-11-24
▶
OSV
linux-aws-6.8 vulnerabilities↗2025-11-12
▶

📋Vendor Advisories

32
Ubuntu
Linux kernel (Azure, N-Series) vulnerabilities↗2026-01-09
▶
Ubuntu
Linux kernel (Azure FIPS) vulnerabilities↗2025-12-17
▶
Ubuntu
Linux kernel (Raspberry Pi) vulnerabilities↗2025-11-25
▶
Ubuntu
Linux kernel (Raspberry Pi Real-time) vulnerabilities↗2025-11-24
▶
Ubuntu
Linux kernel (AWS) vulnerabilities↗2025-11-12
▶
CVE-2025-39728 — Improper Validation of Array Index | cvebase