CVE-2025-39836: efi: stmm: Fix incorrect buffer allocation method
In the Linux kernel, the following vulnerability has been resolved:
efi: stmm: Fix incorrect buffer allocation method
The communication buffer allocated by setupmmhdr() is later on passed to teeshmregisterkernelbuf(). The latter expects those buffers to be contiguous pages, but setupmmhdr() just uses kmalloc(). That can cause various corruptions or BUGs, specifically since commit 9aec2fb0fd5e ("slab: allocate frozen pages"), though it was broken before as well.
Fix this by using allocpagesexact() instead of kmalloc().
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-39836?
CVE-2025-39836 has been assessed with a medium severity level due to potential risks in buffer allocation methods.
How do I fix CVE-2025-39836?
To fix CVE-2025-39836, update your Linux kernel to the latest patched version that addresses this allocation vulnerability.
What does CVE-2025-39836 affect?
CVE-2025-39836 affects the Linux kernel through incorrect buffer allocation methods in communication handling.
Is there a workaround for CVE-2025-39836?
There are no known workarounds for CVE-2025-39836; upgrading to a safe version is recommended.
When was CVE-2025-39836 disclosed?
CVE-2025-39836 was disclosed in 2025 as a vulnerability in the Linux kernel relating to memory handling.