CVE-2025-39785 (GCVE-0-2025-39785)

Vulnerability from cvelistv5 – Published: 2025-09-11 16:56 – Updated: 2026-08-05 12:05
VLAI
Title
drm/hisilicon/hibmc: fix irq_request()'s irq name variable is local
Summary
In the Linux kernel, the following vulnerability has been resolved: drm/hisilicon/hibmc: fix irq_request()'s irq name variable is local The local variable is passed in request_irq (), and there will be use after free problem, which will make request_irq failed. Using the global irq name instead of it to fix.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: b11bc1ae46587f3563c47078e605184f18e7fa57 , < 06d261a085a11600f5b577bb56a65fb2c3e57d0a (git)
Affected: b11bc1ae46587f3563c47078e605184f18e7fa57 , < 8bed4ec42a4e0dc8113172696ff076d1eb6d8bcb (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.16
Unaffected: 0 , < 6.16 (semver)
Unaffected: 6.16.4 , ≤ 6.16.* (semver)
Unaffected: 6.17 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_drv.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "06d261a085a11600f5b577bb56a65fb2c3e57d0a",
              "status": "affected",
              "version": "b11bc1ae46587f3563c47078e605184f18e7fa57",
              "versionType": "git"
            },
            {
              "lessThan": "8bed4ec42a4e0dc8113172696ff076d1eb6d8bcb",
              "status": "affected",
              "version": "b11bc1ae46587f3563c47078e605184f18e7fa57",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_drv.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.16"
            },
            {
              "lessThan": "6.16",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.16.*",
              "status": "unaffected",
              "version": "6.16.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.17",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.16.4",
                  "versionStartIncluding": "6.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.17",
                  "versionStartIncluding": "6.16",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/hisilicon/hibmc: fix irq_request()\u0027s irq name variable is local\n\nThe local variable is passed in request_irq (), and there will be use\nafter free problem, which will make request_irq failed. Using the global\nirq name instead of it to fix."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The stale `irqaction-\u003ename` pointer is dereferenced by `show_interrupts()` when userspace reads the world-readable `/proc/interrupts`, which requires local system access. There is no network-facing consumer of this data.\nAC:L - The dangling pointer is installed unconditionally at driver probe on every affected system, so a single `cat /proc/interrupts` deterministically dereferences freed stack memory; the attacker can additionally groom the recycled VMAP task stack with fork/exit churn to control or unmap the target.\nPR:L - `/proc/interrupts` is created with mode 0444, so any unprivileged local user \u2014 including one confined to a container with `/proc` mounted \u2014 can trigger the read with no capabilities. No authentication beyond a normal shell is needed.\nUI:N - The attacker only reads a procfs file; no victim action, mount, or file-open by another user is required. The vulnerable state is established automatically at boot when the hibmc PCI device probes.\nS:U - The stale read and its consequences are confined to the kernel\u0027s own security authority on the affected host, with no crossing of a VM, IOMMU, or hypervisor boundary.\nC:H - `seq_printf(\"%s\", action-\u003ename)` walks memory unbounded until a NUL byte, dumping arbitrary kernel stack contents into a world-readable file \u2014 leaking kernel pointers (KASLR/heap defeat) and, because VMAP task stacks are recycled into other tasks, residual data from other and potentially privileged processes. This is not a small bounded read.\nI:H - The commit fixes a use-after-free: a dangling pointer is left embedded in the long-lived `irqaction` structure, and its target is attacker-groomable recycled kernel stack memory whose contents are then consumed by kernel formatting code and emitted into procfs and dmesg. Per use-after-free scoring this is treated as High.\nA:H - If the freed stack was `vfree_atomic()`d or the unbounded string walk crosses a vmap guard page, the fault occurs inside `show_interrupts()` while `desc-\u003elock` is held as a raw spinlock with IRQs disabled \u2014 an oops that leaves the IRQ descriptor lock permanently held, deadlocking subsequent IRQ and procfs access, and a full panic under `panic_on_oops`. Any unprivileged user, or routine readers like irqbalance and monitoring agents, can trigger it repeatedly."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:05:06.443Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/06d261a085a11600f5b577bb56a65fb2c3e57d0a"
        },
        {
          "url": "https://git.kernel.org/stable/c/8bed4ec42a4e0dc8113172696ff076d1eb6d8bcb"
        }
      ],
      "title": "drm/hisilicon/hibmc: fix irq_request()\u0027s irq name variable is local",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-39785",
    "datePublished": "2025-09-11T16:56:34.955Z",
    "dateReserved": "2025-04-16T07:20:57.131Z",
    "dateUpdated": "2026-08-05T12:05:06.443Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-39785",
      "date": "2026-10-02",
      "epss": "0.00137",
      "percentile": "0.02634"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_drv.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "06d261a085a11600f5b577bb56a65fb2c3e57d0a",
                    "status": "affected",
                    "version": "b11bc1ae46587f3563c47078e605184f18e7fa57",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "8bed4ec42a4e0dc8113172696ff076d1eb6d8bcb",
                    "status": "affected",
                    "version": "b11bc1ae46587f3563c47078e605184f18e7fa57",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_drv.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "6.16"
                  },
                  {
                    "lessThan": "6.16",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.16.*",
                    "status": "unaffected",
                    "version": "6.16.4",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "6.17",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "26A22BE8-0D22-4155-AED4-BB823BB934AB",
                    "versionEndExcluding": "6.16.4",
                    "versionStartIncluding": "6.16",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.17:rc1:*:*:*:*:*:*",
                    "matchCriteriaId": "327D22EF-390B-454C-BD31-2ED23C998A1C",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.17:rc2:*:*:*:*:*:*",
                    "matchCriteriaId": "C730CD9A-D969-4A8E-9522-162AAF7C0EE9",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/hisilicon/hibmc: fix irq_request()\u0027s irq name variable is local\n\nThe local variable is passed in request_irq (), and there will be use\nafter free problem, which will make request_irq failed. Using the global\nirq name instead of it to fix."
          }
        ],
        "id": "CVE-2025-39785",
        "lastModified": "2026-07-30T06:23:44.997",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            },
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 5.5,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "NONE",
                "integrityImpact": "NONE",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 3.6,
              "source": "nvd@nist.gov",
              "type": "Primary"
            }
          ]
        },
        "published": "2025-09-11T17:15:44.630",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/06d261a085a11600f5b577bb56a65fb2c3e57d0a"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/8bed4ec42a4e0dc8113172696ff076d1eb6d8bcb"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Modified",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-416"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "None",
      "current_release_date": "2026-06-30T10:23:18+00:00",
      "cve": "CVE-2025-39785",
      "id": "CVE-2025-39785",
      "initial_release_date": "2025-09-11T00:00:00+00:00",
      "product_status:known_not_affected": "274",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: drm/hisilicon/hibmc: fix irq_request()\u0027s irq name variable is local",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-39785.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-08-29T01:16:56Z",
      "cve": "CVE-2025-39785",
      "id": "CVE-2025-39785",
      "initial_release_date": "2025-09-11T23:23:45Z",
      "product_status:known_not_affected": "523",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2025-39785",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2025-39785.json",
      "version": "10"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.