CVE-2025-39778 — Out-of-bounds Read in Linux
Severity
7.1HIGHNVD
OSV5.9
EPSS
0.1%
top 79.51%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
Timeline
PublishedApr 18
Latest updateJul 8
Description
In the Linux kernel, the following vulnerability has been resolved:
objtool, nvmet: Fix out-of-bounds stack access in nvmet_ctrl_state_show()
The csts_state_names[] array only has six sparse entries, but the
iteration code in nvmet_ctrl_state_show() iterates seven, resulting in a
potential out-of-bounds stack read. Fix that.
Fixes the following warning with an UBSAN kernel:
vmlinux.o: warning: objtool: .text.nvmet_ctrl_state_show: unexpected end of section
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:HExploitability: 1.8 | Impact: 5.2
Affected Packages5 packages
▶CVEListV5linux/linux649fd41420a816b11b07423ebf4dbd4ac1ac2905 — 1adc93a525fdee8e2b311e6d5fd93eb69714ca05+4
Patches
🔴Vulnerability Details
9OSV▶
linux, linux-aws, linux-gcp, linux-gcp-6.11, linux-hwe-6.11, linux-oracle, linux-raspi, linux-realtime vulnerabilities↗2025-06-30