CVE-2025-39882Use After Free in Linux

CWE-416Use After Free5 documents5 sources
Severity
7.8HIGHNVD
EPSS
0.0%
top 95.24%
CISA KEV
Not in KEV
Exploit
No known exploits
Timeline
PublishedSep 23

Description

In the Linux kernel, the following vulnerability has been resolved: drm/mediatek: fix potential OF node use-after-free The for_each_child_of_node() helper drops the reference it takes to each node as it iterates over children and an explicit of_node_put() is only needed when exiting the loop early. Drop the recently introduced bogus additional reference count decrement at each iteration that could potentially lead to a use-after-free.

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HExploitability: 1.8 | Impact: 5.9

Affected Packages4 packages

NVDlinux/linux_kernel6.6.1056.6.107+3
Debianlinux/linux_kernel< 6.12.48-1+1
CVEListV5linux/linux7d98166183d627c0b9daca7672b2191fae0f8a03b2fbe0f9f80b9cfa1e06ddcf8b863d918394ef1d+6
debiandebian/linux< linux 6.16.8-1 (forky)

Patches

🔴Vulnerability Details

2
OSV
CVE-2025-39882: In the Linux kernel, the following vulnerability has been resolved: drm/mediatek: fix potential OF node use-after-free The for_each_child_of_node() he2025-09-23
GHSA
GHSA-wpx2-5m46-33qp: In the Linux kernel, the following vulnerability has been resolved: drm/mediatek: fix potential OF node use-after-free The for_each_child_of_node()2025-09-23

📋Vendor Advisories

2
Red Hat
kernel: drm/mediatek: fix potential OF node use-after-free2025-09-23
Debian
CVE-2025-39882: linux - In the Linux kernel, the following vulnerability has been resolved: drm/mediate...2025
CVE-2025-39882 — Use After Free in Linux | cvebase