CVE-2025-39817 – A slab-out-of-bounds memory access vulnerabilit... (How to Fix)

Q: What is the severity of CVE-2025-39817?

CVE-2025-39817 has a CVSS score of 7.1 (HIGH). A slab-out-of-bounds memory access vulnerability in the Linux kernel's efivarfs filesystem allows attackers to cause kernel memory corruption through parallel directory lookups with specially crafted filenames. This affects Linux systems using efivarfs (typically systems with UEFI firmware). The vulnerability can lead to system crashes or potential privilege escalation.

📋 TL;DR

A slab-out-of-bounds memory access vulnerability in the Linux kernel's efivarfs filesystem allows attackers to cause kernel memory corruption through parallel directory lookups with specially crafted filenames. This affects Linux systems using efivarfs (typically systems with UEFI firmware). The vulnerability can lead to system crashes or potential privilege escalation.

💻 Affected Systems

Products:

Linux kernel

Versions: Kernel 6.6 and earlier versions containing the vulnerable efivarfs code (present in master branch as well)

Operating Systems: Linux distributions using affected kernel versions

Default Config Vulnerable: ⚠️ Yes

Notes: Only affects systems with efivarfs mounted (typically UEFI-based systems). The vulnerability requires parallel lookups with invalid filenames to trigger.

📦 What is this software?

Debian Linux by Debian

View all CVEs affecting Debian Linux →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Kernel memory corruption leading to system crash, denial of service, or potential privilege escalation to kernel mode.

🟠

Likely Case

System crash or kernel panic resulting in denial of service, requiring system reboot.

🟢

If Mitigated

No impact if efivarfs is not mounted or system is patched.

🌐 Internet-Facing: LOW - Requires local access to trigger the vulnerability.

🏢 Internal Only: MEDIUM - Local attackers or malicious users could exploit this to crash systems or potentially gain elevated privileges.

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: UNKNOWN

Unauthenticated Exploit: ✅ No

Complexity: MEDIUM

Exploitation requires local access and ability to trigger parallel directory lookups with specially crafted filenames. The vulnerability was discovered through KASAN reports.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Patched in kernel commits: 0f63fbabeaaaaaaf5b742a2f4c1b4590d50bf1f6, 568e7761279b99c6daa3002290fd6d8047ddb6d2, 71581a82f38e5a4d807d71fc1bb59aead80ccf95, 794399019301944fd6d2e0d7a51b3327e26c410e, 925599eba46045930b850a98ae594d2e3028ac40

Vendor Advisory: https://git.kernel.org/stable/c/0f63fbabeaaaaaaf5b742a2f4c1b4590d50bf1f6

Restart Required: Yes

Instructions:

1. Update Linux kernel to a patched version from your distribution's repositories. 2. Reboot the system to load the new kernel. 3. Verify the kernel version after reboot.

🔧 Temporary Workarounds

Unmount efivarfs

linux

Unmount the efivarfs filesystem to prevent exploitation of this vulnerability.

umount /sys/firmware/efi/efivars

Disable efivarfs at boot

linux

Prevent efivarfs from being mounted at system boot.

echo 'efivarfs' >> /etc/modprobe.d/disable-efivarfs.conf
echo 'blacklist efivarfs' >> /etc/modprobe.d/disable-efivarfs.conf

🧯 If You Can't Patch

Implement strict access controls to limit who can create files in efivarfs directories
Monitor system logs for kernel panic or KASAN error messages related to efivarfs

🔍 How to Verify

Check if Vulnerable:

Check if efivarfs is mounted: mount | grep efivarfs. If mounted and kernel version is 6.6 or earlier, system is vulnerable.

Check Version:

uname -r

Verify Fix Applied:

Check kernel version after update: uname -r. Verify the kernel version includes one of the fix commits from your distribution.

📡 Detection & Monitoring

Log Indicators:

Kernel panic messages
KASAN error reports mentioning efivarfs_d_compare or memcmp+0x98/0xd0
System crash/reboot logs

Network Indicators:

None - this is a local vulnerability

SIEM Query:

source="kernel" AND ("KASAN" OR "slab-out-of-bounds" OR "efivarfs")

📊 Metadata

CVE ID: CVE-2025-39817

CVSS v3 Score: 7.1 (HIGH)

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

CWE: CWE-125

EPSS Score: 0.01% exploit probability (1th percentile)

Published: September 16, 2025

Last Updated: January 16, 2026

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2025-39817, you might also want to check these: