CVE-2025-39945: linux kernel from 2.6.37 (inclusive), before 5.4.300 (exclusive), from 5.5 (inclusive), before 5.10.245 (exclusive)…

Affected technology

linux kernel · from 2.6.37 (inclusive), before 5.4.300 (exclusive)
linux

linux kernel · from 5.5 (inclusive), before 5.10.245 (exclusive)
linux

linux kernel · from 5.11 (inclusive), before 5.15.194 (exclusive)
linux

linux kernel · from 5.16 (inclusive), before 6.1.154 (exclusive)
linux

linux kernel · from 6.2 (inclusive), before 6.6.108 (exclusive)
linux

linux kernel · from 6.7 (inclusive), before 6.12.49 (exclusive)
linux

linux kernel · from 6.13 (inclusive), before 6.16.9 (exclusive)
linux

linux kernel · 6.17 · update rc1
linux

linux kernel · 6.17 · update rc2
linux

linux kernel · 6.17 · update rc3
linux

linux kernel · 6.17 · update rc4
linux

linux kernel · 6.17 · update rc5
linux

linux kernel · 6.17 · update rc6
linux

Linux · fdf24086f4752aee5dfb40143c736250df017820 to before fde6e73189f40ebcf0633aed2b68e731c25f3aa3, fdf24086f4752aee5dfb40143c736250df017820 to before 7b6a5b0a6b392263c3767fc945b311ea04b34bbd, fdf24086f4752aee5dfb40143c736250df017820 to before 0405055930264ea8fd26f4131466fa7652e5e47d, fdf24086f4752aee5dfb40143c736250df017820 to before e1fcd4a9c09feac0902a65615e866dbf22616125, fdf24086f4752aee5dfb40143c736250df017820 to before 8eeb2091e72d75df8ceaa2172638d61b4cf8929a, fdf24086f4752aee5dfb40143c736250df017820 to before 6e33a7eed587062ca8161ad1f4584882a860d697, fdf24086f4752aee5dfb40143c736250df017820 to before 0627e1481676669cae2df0d85b5ff13e7d24c390, fdf24086f4752aee5dfb40143c736250df017820 to before cfa7d9b1e3a8604afc84e9e51d789c29574fb216
Linux

Linux · 2.6.37
Linux

Component: Not specified by the source
File: drivers/net/ethernet/broadcom/cnic.c

Attack conditions (Source advisory, CVSS 3.1): Local · Low privileges required · No user interaction required

Attack conditions (NVD, CVSS 3.1): Local · Low privileges required · No user interaction required

What an attacker can do

A local attacker with low privileges could trigger a use-after-free error. Source advisory’s CVSS 3.1 assessment (base score 7.8/10) rates confidentiality, integrity and availability impact as high. NVD’s CVSS 3.1 assessment (base score 7.8/10) rates confidentiality, integrity and availability impact as high. The description does not state a further attacker outcome.