Login Sign Up

CVE-2025-39907

5.5 MEDIUM

📋 TL;DR

A DMA mapping vulnerability in the Linux kernel's STM32 FMC2 NAND controller driver causes overlapping memory mappings when handling ECC buffers, triggering kernel warnings and potential system instability. This affects Linux systems using STM32 processors with the FMC2 NAND controller. The issue occurs during NAND flash operations and can lead to system crashes or unpredictable behavior.

💻 Affected Systems

Products:
  • Linux kernel with STM32 FMC2 NAND controller driver
Versions: Linux kernel versions containing the vulnerable stm32_fmc2 driver, specifically around 6.1.82 and related versions
Operating Systems: Linux distributions running on STM32 processors
Default Config Vulnerable: ⚠️ Yes
Notes: Only affects systems using STM32 processors with FMC2 NAND controller hardware and the corresponding kernel driver enabled.

📦 What is this software?

Debian Linux by Debian

View all CVEs affecting Debian Linux →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

⚠️ Risk & Real-World Impact

🔴

Worst Case

System crash or kernel panic during NAND flash operations, potentially causing data corruption or system instability.

🟠

Likely Case

Kernel warning messages and potential performance degradation during NAND operations, with possible system instability under heavy I/O load.

🟢

If Mitigated

Minor performance impact with warning messages in kernel logs, but system remains operational.

🌐 Internet-Facing: LOW - This is a local driver issue requiring physical or local access to trigger.
🏢 Internal Only: MEDIUM - Systems using STM32 NAND controllers could experience instability during storage operations.

🎯 Exploit Status

Public PoC: ✅ No
Weaponized: NO
Unauthenticated Exploit: ✅ No
Complexity: HIGH - Requires specific hardware and driver interaction

This appears to be a stability/performance issue rather than a security vulnerability with traditional exploitation vectors. The main risk is system instability.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Patched in kernel commits: 06d8ef8f853752fea88c8d5bb093a40e71b330cf, 26adba1e7d7924174e15a3ba4b1132990786300b, 513c40e59d5a414ab763a9c84797534b5e8c208d, 75686c49574dd5f171ca682c18717787f1d8d55e, dc1c6e60993b93b87604eb11266ac72e1a3be9e0

Vendor Advisory: https://git.kernel.org/stable/c/06d8ef8f853752fea88c8d5bb093a40e71b330cf

Restart Required: Yes

Instructions:

1. Update Linux kernel to version containing the fix commits. 2. Rebuild kernel if using custom kernel. 3. Reboot system to load patched kernel.

🔧 Temporary Workarounds

Disable STM32 FMC2 NAND controller

linux

Disable the vulnerable driver if NAND storage is not required

echo 'blacklist stm32_fmc2_nfc' >> /etc/modprobe.d/blacklist.conf
rmmod stm32_fmc2_nfc

🧯 If You Can't Patch

  • Monitor kernel logs for DMA-API warnings related to stm32_fmc2_nfc
  • Avoid heavy NAND flash operations on affected systems

🔍 How to Verify

Check if Vulnerable:

Check kernel logs for 'DMA-API: stm32_fmc2_nfc' warnings or check if stm32_fmc2_nfc module is loaded: lsmod | grep stm32_fmc2_nfc

Check Version:

uname -r

Verify Fix Applied:

Check kernel version contains fix commits or verify no DMA-API warnings appear in logs during NAND operations

📡 Detection & Monitoring

Log Indicators:

  • DMA-API: stm32_fmc2_nfc: cacheline tracking EEXIST
  • WARNING: CPU: at kernel/dma/debug.c:568 add_dma_entry

Network Indicators:

  • None - this is a local driver issue

SIEM Query:

source="kernel" AND "stm32_fmc2_nfc" AND "DMA-API"

📊 Metadata

CVE ID: CVE-2025-39907
CVSS v3 Score: 5.5 (MEDIUM)
CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
EPSS Score: 0.04% exploit probability (11.3th percentile)
Published: October 1, 2025
Last Updated: January 16, 2026

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON