CVE-2025-39837
published 2025-09-19CVE-2025-39837: In the Linux kernel, the following vulnerability has been resolved: platform/x86: asus-wmi: Fix racy registrations asus_wmi_register_driver() may be called…
PriorityP336high7.8CVSS 3.1
AVLACLPRLUINSUCHIHAH
EPSS
0.14%
4.1th percentile
In the Linux kernel, the following vulnerability has been resolved:
platform/x86: asus-wmi: Fix racy registrations
asus_wmi_register_driver() may be called from multiple drivers
concurrently, which can lead to the racy list operations, eventually
corrupting the memory and hitting Oops on some ASUS machines.
Also, the error handling is missing, and it forgot to unregister ACPI
lps0 dev ops in the error case.
This patch covers those issues by introducing a simple mutex at
acpi_wmi_register_driver() & *_unregister_driver, and adding the
proper call of asus_s2idle_check_unregister() in the error path.
Affected
7 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | linux | < linux 6.16.6-1 (forky) | linux 6.16.6-1 (forky) |
| linux | linux | — | — |
| linux | linux | >= feea7bd6b02d43a794e3f065650d89cf8d8e8e59 < e7a70326fb26b905cfc8fe2366113aa4394733ef | e7a70326fb26b905cfc8fe2366113aa4394733ef |
| linux | linux | >= feea7bd6b02d43a794e3f065650d89cf8d8e8e59 < 5549202b9c02c2ecbc8634768a3da8d9e82d548d | 5549202b9c02c2ecbc8634768a3da8d9e82d548d |
| linux | linux_kernel | — | — |
| linux | linux_kernel | >= 0 < 6.16.6-1 | 6.16.6-1 |
| linux | linux_kernel | >= 6.16 < 6.16.6 | 6.16.6 |
CVSS provenance
nvdv3.17.8HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
osv7.8HIGH
vendor_debian7.8LOW
vendor_redhat7.8HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-g3gw-5g8v-fphj: In the Linux kernel, the following vulnerability has been resolved:
platform/x86: asus-wmi: Fix racy registrations
asus_wmi_register_driver() may be
ghsa_unreviewed·2025-09-22
CVE-2025-39837 [HIGH] CWE-787 GHSA-g3gw-5g8v-fphj: In the Linux kernel, the following vulnerability has been resolved:
platform/x86: asus-wmi: Fix racy registrations
asus_wmi_register_driver() may be
In the Linux kernel, the following vulnerability has been resolved:
platform/x86: asus-wmi: Fix racy registrations
asus_wmi_register_driver() may be called from multiple drivers
concurrently, which can lead to the racy list operations, eventually
corrupting the memory and hitting Oops on some ASUS machines.
Also, the error handling is missing, and it forgot to unregister ACPI
lps0 dev ops in the error case.
This patch covers those issues by introducing a simple mutex at
acpi_wmi_register_driver() & *_unregister_driver, and adding the
proper call of asus_s2idle_check_unregister() in the error path.
OSV
CVE-2025-39837: In the Linux kernel, the following vulnerability has been resolved: platform/x86: asus-wmi: Fix racy registrations asus_wmi_register_driver() may be c
osv·2025-09-19·CVSS 7.8
CVE-2025-39837 [HIGH] CVE-2025-39837: In the Linux kernel, the following vulnerability has been resolved: platform/x86: asus-wmi: Fix racy registrations asus_wmi_register_driver() may be c
In the Linux kernel, the following vulnerability has been resolved: platform/x86: asus-wmi: Fix racy registrations asus_wmi_register_driver() may be called from multiple drivers concurrently, which can lead to the racy list operations, eventually corrupting the memory and hitting Oops on some ASUS machines. Also, the error handling is missing, and it forgot to unregister ACPI lps0 dev ops in the error case. This patch covers those issues by introducing a simple mutex at acpi_wmi_register_driver() & *_unregister_driver, and adding the proper call of asus_s2idle_check_unregister() in the error path.
Red Hat
kernel: platform/x86: asus-wmi: Fix racy registrations
vendor_redhat·2025-09-19·CVSS 7.8
CVE-2025-39837 [HIGH] kernel: platform/x86: asus-wmi: Fix racy registrations
kernel: platform/x86: asus-wmi: Fix racy registrations
In the Linux kernel, the following vulnerability has been resolved:
platform/x86: asus-wmi: Fix racy registrations
asus_wmi_register_driver() may be called from multiple drivers
concurrently, which can lead to the racy list operations, eventually
corrupting the memory and hitting Oops on some ASUS machines.
Also, the error handling is missing, and it forgot to unregister ACPI
lps0 dev ops in the error case.
This patch covers those issues by introducing a simple mutex at
acpi_wmi_register_driver() & *_unregister_driver, and adding the
proper call of asus_s2idle_check_unregister() in the error path.
Package: kernel (Red Hat Enterprise Linux 10) - Not affected
Package: kernel (Red Hat Enterprise Linux 6) - Not affected
Package: kernel
Debian
CVE-2025-39837: linux - In the Linux kernel, the following vulnerability has been resolved: platform/x8...
vendor_debian·2025·CVSS 7.8
CVE-2025-39837 [HIGH] CVE-2025-39837: linux - In the Linux kernel, the following vulnerability has been resolved: platform/x8...
In the Linux kernel, the following vulnerability has been resolved: platform/x86: asus-wmi: Fix racy registrations asus_wmi_register_driver() may be called from multiple drivers concurrently, which can lead to the racy list operations, eventually corrupting the memory and hitting Oops on some ASUS machines. Also, the error handling is missing, and it forgot to unregister ACPI lps0 dev ops in the error case. This patch covers those issues by introducing a simple mutex at acpi_wmi_register_driver() & *_unregister_driver, and adding the proper call of asus_s2idle_check_unregister() in the error path.
Scope: local
bookworm: resolved
bullseye: resolved
forky: resolved (fixed in 6.16.6-1)
sid: resolved (fixed in 6.16.6-1)
trixie: resolved
No detection rules found.
No public exploits indexed.
2025-09-19
Published