CVE-2025-9408: Userspace privilege escalation vulnerability on Cortex M
Published Nov 11, 2025
·Updated
System call entry on Cortex M (and possibly R and A, but I think not) has a race which allows very practical privilege escalation for malicious userspace processes.
Affected Software
1 affected component
Arm Cortex-M
Event History
Nov 11, 2025
CVE Published
via MITRE·03:34 PM
Data Sourced
via MITRE·03:34 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·04:15 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What access does an attacker need?
The attack is local: it requires a malicious userspace process on an affected Arm Cortex-M system. It requires no prior privileges and no user interaction, but exploitation depends on winning a race condition and is rated high complexity.
2
What could a successful exploit allow?
The vulnerability can escalate a malicious userspace process to higher privileges. The CVSS vector indicates high potential impact to confidentiality, integrity, and availability, with impact extending beyond the initially vulnerable security authority.