CVE-2025-39920

MEDIUM

Linux Kernel 2.6.34-6.16.6 - Null Pointer Dereference in do_validate_mem()

Title source: llm
STIX 2.1

Description

In the Linux kernel, the following vulnerability has been resolved: pcmcia: Add error handling for add_interval() in do_validate_mem() In the do_validate_mem(), the call to add_interval() does not handle errors. If kmalloc() fails in add_interval(), it could result in a null pointer being inserted into the linked list, leading to illegal memory access when sub_interval() is called next. This patch adds an error handling for the add_interval(). If add_interval() returns an error, the function will return early with the error code.

Scores

CVSS v3 5.5
EPSS 0.0001
EPSS Percentile 1.6%
Attack Vector LOCAL
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Details

CWE
CWE-476
Status published
Products (28)
debian/debian_linux 11.0
linux/Kernel 2.6.34 - 5.4.299linux
linux/Kernel 5.11.0 - 5.15.192linux
linux/Kernel 5.16.0 - 6.1.151linux
linux/Kernel 5.5.0 - 5.10.243linux
linux/Kernel 6.13.0 - 6.16.6linux
linux/Kernel 6.2.0 - 6.6.105linux
linux/Kernel 6.7.0 - 6.12.46linux
Linux/Linux < 2.6.34
Linux/Linux 2.6.34
... and 18 more
Published Oct 01, 2025
Tracked Since Feb 18, 2026