CVE-2025-39687: iio: light: as73211: Ensure buffer holes are zeroed
In the Linux kernel, the following vulnerability has been resolved:
iio: light: as73211: Ensure buffer holes are zeroed
Given that the buffer is copied to a kfifo that ultimately user space can read, ensure we zero it.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.113-1Fixed in 7.2.12-1Fixed in 7.2.13-1 - Compensating control
Zero all buffer holes before copying the buffer to the kfifo, since the kfifo contents can ultimately be read from user space.
Event History
Frequently Asked Questions
What is the severity of CVE-2025-39687?
CVE-2025-39687 has been categorized as a medium severity vulnerability in the Linux kernel.
How do I fix CVE-2025-39687?
You can fix CVE-2025-39687 by updating to the latest stable version of the Linux kernel that incorporates the patch for this vulnerability.
What systems are affected by CVE-2025-39687?
CVE-2025-39687 affects various versions of the Linux kernel, particularly those with the IIO light driver for the as73211 sensor.
What type of vulnerability is CVE-2025-39687?
CVE-2025-39687 is a buffer handling vulnerability that could potentially lead to data leakage in user space.
Are there any known exploits for CVE-2025-39687?
As of now, there are no publicly known exploits that specifically target CVE-2025-39687.