CVE-2025-39951: linux kernel from 5.5 (inclusive), before 5.10.245 (exclusive), from 5.11 (inclusive), before 5.15.194 (exclusive)…

Affected technology

linux kernel · from 5.5 (inclusive), before 5.10.245 (exclusive)
linux

linux kernel · from 5.11 (inclusive), before 5.15.194 (exclusive)
linux

linux kernel · from 5.16 (inclusive), before 6.1.154 (exclusive)
linux

linux kernel · from 6.2 (inclusive), before 6.6.108 (exclusive)
linux

linux kernel · from 6.7 (inclusive), before 6.12.49 (exclusive)
linux

linux kernel · from 6.13 (inclusive), before 6.16.9 (exclusive)
linux

linux kernel · 6.17 · update rc1
linux

linux kernel · 6.17 · update rc2
linux

linux kernel · 6.17 · update rc3
linux

linux kernel · 6.17 · update rc4
linux

linux kernel · 6.17 · update rc5
linux

linux kernel · 6.17 · update rc6
linux

Linux · 04e5b1fb01834a602acaae2276b67a783a8c6159 to before 14c231959a16ca41bfdcaede72483362a8c645d7, 04e5b1fb01834a602acaae2276b67a783a8c6159 to before 5e94e44c9cb30d7a383d8ac227f24a8c9326b770, 04e5b1fb01834a602acaae2276b67a783a8c6159 to before aaf900a83508c8cd5cdf765e7749f9076196ec7f, 04e5b1fb01834a602acaae2276b67a783a8c6159 to before 4f364023ddcfe83f7073b973a9cb98584b7f2a46, 04e5b1fb01834a602acaae2276b67a783a8c6159 to before 00e98b5a69034b251bb36dc6e7123d7648e218e4, 04e5b1fb01834a602acaae2276b67a783a8c6159 to before c2ff91255e0157b356cff115d8dc3eeb5162edf2, 04e5b1fb01834a602acaae2276b67a783a8c6159 to before 7ebf70cf181651fe3f2e44e95e7e5073d594c9c0
Linux

Linux · 5.5
Linux

Component: Not specified by the source
File: arch/um/drivers/virtio_uml.c

Attack conditions (Source advisory, CVSS 3.1): Local · Low privileges required · No user interaction required

Attack conditions (NVD, CVSS 3.1): Local · Low privileges required · No user interaction required

What an attacker can do

A local attacker with low privileges can trigger a use-after-free error. Source advisory’s CVSS 3.1 assessment (base score 7.8/10) rates confidentiality, integrity and availability impact as high. NVD’s CVSS 3.1 assessment (base score 7.8/10) rates confidentiality, integrity and availability impact as high. The description does not state a further attacker outcome.