CVE-2025-39787
MEDIUMLinux Kernel - Buffer Over-Read in MDT Loader ELF Header Parsing
Title source: llmDescription
In the Linux kernel, the following vulnerability has been resolved: soc: qcom: mdt_loader: Ensure we don't read past the ELF header When the MDT loader is used in remoteproc, the ELF header is sanitized beforehand, but that's not necessary the case for other clients. Validate the size of the firmware buffer to ensure that we don't read past the end as we iterate over the header. e_phentsize and e_shentsize are validated as well, to ensure that the assumptions about step size in the traversal are valid.
References (12)
Core 12
Core References
Third Party Advisory
https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html
Third Party Advisory
https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html
Vendor Advisory
https://cert-portal.siemens.com/productcert/html/ssa-032379.html
Vendor Advisory
https://cert-portal.siemens.com/productcert/html/ssa-082556.html
Scores
CVSS v3
5.5
EPSS
0.0002
EPSS Percentile
4.7%
Attack Vector
LOCAL
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Details
Status
published
Products (27)
debian/debian_linux
11.0
linux/Kernel
4.11.0 - 5.4.297linux
linux/Kernel
5.11.0 - 5.15.190linux
linux/Kernel
5.16.0 - 6.1.149linux
linux/Kernel
5.5.0 - 5.10.241linux
linux/Kernel
6.13.0 - 6.16.4linux
linux/Kernel
6.2.0 - 6.6.103linux
linux/Kernel
6.7.0 - 6.12.44linux
Linux/Linux
< 4.11
Linux/Linux
2aad40d911eeb7dcac91c669f2762a28134f0eb1 - 0d59ce2bfc3bb13abe6240335a1bf7b96536d022
... and 17 more
Published
Sep 11, 2025
Tracked Since
Feb 18, 2026