CVE-2025-39960: gpiolib: acpi: initialize acpi_gpio_info struct
In the Linux kernel, the following vulnerability has been resolved:
gpiolib: acpi: initialize acpigpioinfo struct
Since commit 7c010d463372 ("gpiolib: acpi: Make sure we fill struct acpigpioinfo"), uninitialized acpigpioinfo struct are passed to acpifindgpio() and later in the call stack info->quirks is used in acpipopulategpiolookup. This breaks the i2chidcpi driver:
[ 58.122916] i2chidacpi i2c-UNIW0001:00: HID over i2c has not been provided an Int IRQ [ 58.123097] i2chidacpi i2c-UNIW0001:00: probe with driver i2chidacpi failed with error -22
Fix this by initializing the acpigpioinfo pass to acpifindgpio()
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-39960?
CVE-2025-39960 has been classified with a moderate severity level due to potential risks associated with uninitialized structures in the Linux kernel.
How do I fix CVE-2025-39960?
To fix CVE-2025-39960, update the Linux kernel to the latest version where this vulnerability has been addressed.
Which versions of the Linux kernel are affected by CVE-2025-39960?
CVE-2025-39960 affects earlier versions of the Linux kernel prior to the fix that was implemented in commit 7c010d463372.
What does CVE-2025-39960 affect in the Linux kernel?
CVE-2025-39960 affects the gpiolib component, specifically the acpi_gpio_info struct initialization.
Is CVE-2025-39960 a critical vulnerability?
No, CVE-2025-39960 is not considered critical but poses a moderate security risk that should be addressed.