CVE-2025-39939: iommu/s390: Fix memory corruption when using identity domain
In the Linux kernel, the following vulnerability has been resolved:
iommu/s390: Fix memory corruption when using identity domain
zpcigetiommuctrs() returns counter information to be reported as part of device statistics; these counters are stored as part of the s390domain. The problem, however, is that the identity domain is not backed by an s390domain and so the conversion via tos390domain() yields a bad address that is zero'd initially and read on-demand later via a sysfs read. These counters aren't necessary for the identity domain; just return NULL in this case.
This issue was discovered via KASAN with reports that look like: BUG: KASAN: global-out-of-bounds in zpcifmbenabledevice when using the identity domain for a device on s390.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-39939?
CVE-2025-39939 is classified as a medium severity vulnerability due to its potential impact on memory corruption.
How do I fix CVE-2025-39939?
To fix CVE-2025-39939, update to the latest version of the Linux kernel that addresses this vulnerability.
What type of systems are affected by CVE-2025-39939?
CVE-2025-39939 affects systems running the Linux kernel, specifically those utilizing the s390 architecture.
What is the nature of the vulnerability in CVE-2025-39939?
CVE-2025-39939 involves memory corruption issues related to the iommu/s390 identity domain functionality.
Has CVE-2025-39939 been patched?
Yes, CVE-2025-39939 has been resolved with patches included in recent Linux kernel updates.