{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 7.8,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2025-39836",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-01-14T18:18:58.242475Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-787",
                "description": "CWE-787 Out-of-bounds Write",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-01-14T18:22:57.320Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/firmware/efi/stmm/tee_stmm_efi.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "77ff27ff0e4529a003c8a1c2492c111968c378d3",
              "status": "affected",
              "version": "c44b6be62e8dd4ee0a308c36a70620613e6fc55f",
              "versionType": "git"
            },
            {
              "lessThan": "630c0e6064daf84f17aad1a7d9ca76b562e3fe47",
              "status": "affected",
              "version": "c44b6be62e8dd4ee0a308c36a70620613e6fc55f",
              "versionType": "git"
            },
            {
              "lessThan": "c5e81e672699e0c5557b2b755cc8f7a69aa92bff",
              "status": "affected",
              "version": "c44b6be62e8dd4ee0a308c36a70620613e6fc55f",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/firmware/efi/stmm/tee_stmm_efi.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.8"
            },
            {
              "lessThan": "6.8",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.45",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.16.*",
              "status": "unaffected",
              "version": "6.16.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.17",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.45",
                  "versionStartIncluding": "6.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.16.5",
                  "versionStartIncluding": "6.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.17",
                  "versionStartIncluding": "6.8",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nefi: stmm: Fix incorrect buffer allocation method\n\nThe communication buffer allocated by setup_mm_hdr() is later on passed\nto tee_shm_register_kernel_buf(). The latter expects those buffers to be\ncontiguous pages, but setup_mm_hdr() just uses kmalloc(). That can cause\nvarious corruptions or BUGs, specifically since commit 9aec2fb0fd5e\n(\"slab: allocate frozen pages\"), though it was broken before as well.\n\nFix this by using alloc_pages_exact() instead of kmalloc()."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable code is reached through local filesystem access to efivarfs (`/sys/firmware/efi/efivars`), which drives the EFI variable operations backed by this driver. There is no network or physical component to the trigger.\nAC:L - Every `read()` of an EFI variable file deterministically executes the kmalloc\u2192`get_page()`\u2192`put_page()` sequence that frees a live slab page; no race, no timing window, and no condition outside the attacker\u0027s control is involved. The attacker even chooses the variable name/size, controlling the kmalloc size class and thus which slab page and neighbouring objects are affected.\nPR:L - efivarfs variable files are created with mode 0644 (`fs/efivarfs/super.c:253`), so any unprivileged local user can open and read them and reach `tee_get_variable()`. No capability, user namespace trick, or root access is required.\nUI:N - The attacker performs the read themselves; no victim action, mount, or interaction is needed. The path is also exercised automatically at driver probe and at efivarfs mount time.\nS:U - The premature page free and resulting memory corruption occur entirely within the kernel\u0027s own security authority, the same component that contains the flaw. Standard kernel heap corruption leading to privilege escalation is scored Unchanged.\nC:H - A live slab page is returned to the buddy allocator while still in use, so the attacker can reclaim that page (e.g. as user memory, another slab, or page tables) and read whatever live kernel objects still occupy it, yielding an arbitrary kernel-memory disclosure primitive. The FF-A registration additionally exposes whole pages of unrelated kernel heap to the secure partition.\nI:H - The same page cross-allocation gives a write view onto live kernel objects \u2014 the attacker can modify data the kernel still believes it owns (including potentially page tables or function pointers in adjacent slab objects), giving a controlled write and control-flow hijack path to privilege escalation.\nA:H - Freeing a page that still has PG_slab set and live allocations produces \"BUG: Bad page state\", refcount `VM_BUG_ON` under CONFIG_DEBUG_VM, and general heap corruption leading to an oops or panic, repeatable at will by an unprivileged user."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:05:30.423Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/77ff27ff0e4529a003c8a1c2492c111968c378d3"
        },
        {
          "url": "https://git.kernel.org/stable/c/630c0e6064daf84f17aad1a7d9ca76b562e3fe47"
        },
        {
          "url": "https://git.kernel.org/stable/c/c5e81e672699e0c5557b2b755cc8f7a69aa92bff"
        }
      ],
      "title": "efi: stmm: Fix incorrect buffer allocation method",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-39836",
    "datePublished": "2025-09-16T13:08:52.326Z",
    "dateReserved": "2025-04-16T07:20:57.141Z",
    "dateUpdated": "2026-08-05T12:05:30.423Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}