CVE-2025-39904 — Use of Uninitialized Resource in Linux

CWE-908 — Use of Uninitialized Resource5 documents5 sources
Severity
5.5MEDIUMNVD
EPSS
0.0%
top 94.52%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
LinuxLinux KernelDebian Linux
Timeline
PublishedOct 1

Description

In the Linux kernel, the following vulnerability has been resolved: arm64: kexec: initialize kexec_buf struct in load_other_segments() Patch series "kexec: Fix invalid field access". The kexec_buf structure was previously declared without initialization. commit bf454ec31add ("kexec_file: allow to place kexec_buf randomly") added a field that is always read but not consistently populated by all architectures. This un-initialized field will contain garbage. This is also triggering a UBSAN warn…

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HExploitability: 1.8 | Impact: 3.6

Affected Packages4 packages

▶NVDlinux/linux_kernel6.16 — 6.16.8+1
▶Debianlinux/linux_kernel< 6.16.8-1
▶CVEListV5linux/linuxbf454ec31add6790f6cdc88328e38901fcbbade6 — 340cc9a3bd30b25edaf6a9708d41b5f2c10a054a+2
▶debiandebian/linux< linux 6.16.8-1 (forky)

Patches

Patch: git.kernel.org ↗Patch: git.kernel.org ↗

🔴Vulnerability Details

2
OSV
CVE-2025-39904: In the Linux kernel, the following vulnerability has been resolved: arm64: kexec: initialize kexec_buf struct in load_other_segments() Patch series "k↗2025-10-01
▶
GHSA
GHSA-9j3f-w66p-jqvg: In the Linux kernel, the following vulnerability has been resolved: arm64: kexec: initialize kexec_buf struct in load_other_segments() Patch series↗2025-10-01
▶

📋Vendor Advisories

2
Red Hat
kernel: arm64: kexec: initialize kexec_buf struct in load_other_segments()↗2025-10-01
▶
Debian
CVE-2025-39904: linux - In the Linux kernel, the following vulnerability has been resolved: arm64: kexe...↗2025
▶
CVE-2025-39904 — Use of Uninitialized Resource in Linux | cvebase