GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2025-39758 (GCVE-0-2025-39758)

Vulnerability from cvelistv5 – Published: 2025-09-11 16:52 – Updated: 2026-08-23 12:45
VLAI
Title
RDMA/siw: Fix the sendmsg byte count in siw_tcp_sendpages
Summary
In the Linux kernel, the following vulnerability has been resolved: RDMA/siw: Fix the sendmsg byte count in siw_tcp_sendpages Ever since commit c2ff29e99a76 ("siw: Inline do_tcp_sendpages()"), we have been doing this: static int siw_tcp_sendpages(struct socket *s, struct page **page, int offset, size_t size) [...] /* Calculate the number of bytes we need to push, for this page * specifically */ size_t bytes = min_t(size_t, PAGE_SIZE - offset, size); /* If we can't splice it, then copy it in, as normal */ if (!sendpage_ok(page[i])) msg.msg_flags &= ~MSG_SPLICE_PAGES; /* Set the bvec pointing to the page, with len $bytes */ bvec_set_page(&bvec, page[i], bytes, offset); /* Set the iter to $size, aka the size of the whole sendpages (!!!) */ iov_iter_bvec(&msg.msg_iter, ITER_SOURCE, &bvec, 1, size); try_page_again: lock_sock(sk); /* Sendmsg with $size size (!!!) */ rv = tcp_sendmsg_locked(sk, &msg, size); This means we've been sending oversized iov_iters and tcp_sendmsg calls for a while. This has a been a benign bug because sendpage_ok() always returned true. With the recent slab allocator changes being slowly introduced into next (that disallow sendpage on large kmalloc allocations), we have recently hit out-of-bounds crashes, due to slight differences in iov_iter behavior between the MSG_SPLICE_PAGES and "regular" copy paths: (MSG_SPLICE_PAGES) skb_splice_from_iter iov_iter_extract_pages iov_iter_extract_bvec_pages uses i->nr_segs to correctly stop in its tracks before OoB'ing everywhere skb_splice_from_iter gets a "short" read (!MSG_SPLICE_PAGES) skb_copy_to_page_nocache copy=iov_iter_count [...] copy_from_iter /* this doesn't help */ if (unlikely(iter->count < len)) len = iter->count; iterate_bvec ... and we run off the bvecs Fix this by properly setting the iov_iter's byte count, plus sending the correct byte count to tcp_sendmsg_locked.
Severity
9.8 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: a19a58ab12695abb91a4e8ecf62cc0bc5badefbe , < b47c4b7cb78b6382c6d1af0bfc0d8218e4f445cc (git)
Affected: c2ff29e99a764769eb2ce3a1a5585013633ee9a6 , < 5661fdd218c2799001b88c17acd19f4395e4488e (git)
Affected: c2ff29e99a764769eb2ce3a1a5585013633ee9a6 , < 673cf582fd788af12cdacfb62a6a593083542481 (git)
Affected: c2ff29e99a764769eb2ce3a1a5585013633ee9a6 , < 42ebc16d9d2563f1a1ce0f05b643ee68d54fabf8 (git)
Affected: c2ff29e99a764769eb2ce3a1a5585013633ee9a6 , < edf82bc8150570167a33a7d54627d66614cbf841 (git)
Affected: c2ff29e99a764769eb2ce3a1a5585013633ee9a6 , < c18646248fed07683d4cee8a8af933fc4fe83c0d (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.5
Unaffected: 0 , < 6.5 (semver)
Unaffected: 6.6.103 , ≤ 6.6.* (semver)
Unaffected: 6.12.43 , ≤ 6.12.* (semver)
Unaffected: 6.15.11 , ≤ 6.15.* (semver)
Unaffected: 6.16.2 , ≤ 6.16.* (semver)
Unaffected: 6.17 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/infiniband/sw/siw/siw_qp_tx.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "b47c4b7cb78b6382c6d1af0bfc0d8218e4f445cc",
              "status": "affected",
              "version": "a19a58ab12695abb91a4e8ecf62cc0bc5badefbe",
              "versionType": "git"
            },
            {
              "lessThan": "5661fdd218c2799001b88c17acd19f4395e4488e",
              "status": "affected",
              "version": "c2ff29e99a764769eb2ce3a1a5585013633ee9a6",
              "versionType": "git"
            },
            {
              "lessThan": "673cf582fd788af12cdacfb62a6a593083542481",
              "status": "affected",
              "version": "c2ff29e99a764769eb2ce3a1a5585013633ee9a6",
              "versionType": "git"
            },
            {
              "lessThan": "42ebc16d9d2563f1a1ce0f05b643ee68d54fabf8",
              "status": "affected",
              "version": "c2ff29e99a764769eb2ce3a1a5585013633ee9a6",
              "versionType": "git"
            },
            {
              "lessThan": "edf82bc8150570167a33a7d54627d66614cbf841",
              "status": "affected",
              "version": "c2ff29e99a764769eb2ce3a1a5585013633ee9a6",
              "versionType": "git"
            },
            {
              "lessThan": "c18646248fed07683d4cee8a8af933fc4fe83c0d",
              "status": "affected",
              "version": "c2ff29e99a764769eb2ce3a1a5585013633ee9a6",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/infiniband/sw/siw/siw_qp_tx.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.5"
            },
            {
              "lessThan": "6.5",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.103",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.43",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.15.*",
              "status": "unaffected",
              "version": "6.15.11",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.16.*",
              "status": "unaffected",
              "version": "6.16.2",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.17",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.103",
                  "versionStartIncluding": "6.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.43",
                  "versionStartIncluding": "6.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.15.11",
                  "versionStartIncluding": "6.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.16.2",
                  "versionStartIncluding": "6.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.17",
                  "versionStartIncluding": "6.5",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/siw: Fix the sendmsg byte count in siw_tcp_sendpages\n\nEver since commit c2ff29e99a76 (\"siw: Inline do_tcp_sendpages()\"),\nwe have been doing this:\n\nstatic int siw_tcp_sendpages(struct socket *s, struct page **page, int offset,\n                             size_t size)\n[...]\n        /* Calculate the number of bytes we need to push, for this page\n         * specifically */\n        size_t bytes = min_t(size_t, PAGE_SIZE - offset, size);\n        /* If we can\u0027t splice it, then copy it in, as normal */\n        if (!sendpage_ok(page[i]))\n                msg.msg_flags \u0026= ~MSG_SPLICE_PAGES;\n        /* Set the bvec pointing to the page, with len $bytes */\n        bvec_set_page(\u0026bvec, page[i], bytes, offset);\n        /* Set the iter to $size, aka the size of the whole sendpages (!!!) */\n        iov_iter_bvec(\u0026msg.msg_iter, ITER_SOURCE, \u0026bvec, 1, size);\ntry_page_again:\n        lock_sock(sk);\n        /* Sendmsg with $size size (!!!) */\n        rv = tcp_sendmsg_locked(sk, \u0026msg, size);\n\nThis means we\u0027ve been sending oversized iov_iters and tcp_sendmsg calls\nfor a while. This has a been a benign bug because sendpage_ok() always\nreturned true. With the recent slab allocator changes being slowly\nintroduced into next (that disallow sendpage on large kmalloc\nallocations), we have recently hit out-of-bounds crashes, due to slight\ndifferences in iov_iter behavior between the MSG_SPLICE_PAGES and\n\"regular\" copy paths:\n\n(MSG_SPLICE_PAGES)\nskb_splice_from_iter\n  iov_iter_extract_pages\n    iov_iter_extract_bvec_pages\n      uses i-\u003enr_segs to correctly stop in its tracks before OoB\u0027ing everywhere\n  skb_splice_from_iter gets a \"short\" read\n\n(!MSG_SPLICE_PAGES)\nskb_copy_to_page_nocache copy=iov_iter_count\n [...]\n   copy_from_iter\n        /* this doesn\u0027t help */\n        if (unlikely(iter-\u003ecount \u003c len))\n                len = iter-\u003ecount;\n          iterate_bvec\n            ... and we run off the bvecs\n\nFix this by properly setting the iov_iter\u0027s byte count, plus sending the\ncorrect byte count to tcp_sendmsg_locked."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - siw is an iWARP/RDMA transport running over TCP, and the overrun parameters (`read_size`, `source_to`/page offset, and GSO/FPDU segment size) come straight from a remote peer\u0027s RDMA READ Request via `siw_init_rresp()`; the same TX path serves network-facing kernel ULPs (nfsd/RDMA, ksmbd SMB Direct, nvmet-rdma) layered on soft-iWARP, and the out-of-bounds data is copied into the TCP skb and sent back over the network.\nAC:L - The attacker deterministically creates the overrun by choosing a non-page-aligned local offset with a transfer length \u2265 PAGE_SIZE, which forces `size \u003e bytes` on the very first iteration; `zcopy_tx` is on by default and READ.Responses are always non-signalled, so no race or unpredictable state is involved.\nPR:N - A remote iWARP peer needs only an established MPA/TCP connection to a soft-iWARP target \u2014 nvmet-rdma and NFS/RDMA targets accept connections with no transport-level authentication, and the \u22654 KB kmalloc-backed reply/READ-Response path is exercised immediately after connect.\nUI:N - The overrun happens entirely inside the kernel\u0027s RDMA transmit path while servicing a peer-initiated request; no local user has to open, mount, or click anything.\nS:U - The out-of-bounds access and its consequences are confined to the kernel\u0027s own memory and the affected RDMA connection, with no crossing of a VM, IOMMU, or other security-authority boundary.\nC:H - `iterate_bvec()` fabricates `struct page *` values from stack residue and copies memory from those arbitrary kernel addresses into the outgoing TCP stream, so kernel memory \u2014 up to ~64 KB per FPDU \u2014 is disclosed directly to the remote peer, an effectively arbitrary kernel read primitive.\nI:H - Kernel memory is substituted for legitimate RDMA payload delivered to the peer, silently corrupting data that NFS/RDMA, SMB Direct, and NVMe-oF clients commit to files and block devices, and the oversized return value underflows the `size_t bytes` counter, corrupting siw\u0027s send-length accounting and retry loop.\nA:H - Dereferencing fabricated `struct page` pointers via `kmap_local_page()` and memcpy\u0027ing from unmapped addresses reliably oopses or panics the kernel \u2014 the crashes the fix commit reports \u2014 and the `bytes` underflow can wedge the transmit loop; the attacker can repeat this at will."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-23T12:45:23.784Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/b47c4b7cb78b6382c6d1af0bfc0d8218e4f445cc"
        },
        {
          "url": "https://git.kernel.org/stable/c/5661fdd218c2799001b88c17acd19f4395e4488e"
        },
        {
          "url": "https://git.kernel.org/stable/c/673cf582fd788af12cdacfb62a6a593083542481"
        },
        {
          "url": "https://git.kernel.org/stable/c/42ebc16d9d2563f1a1ce0f05b643ee68d54fabf8"
        },
        {
          "url": "https://git.kernel.org/stable/c/edf82bc8150570167a33a7d54627d66614cbf841"
        },
        {
          "url": "https://git.kernel.org/stable/c/c18646248fed07683d4cee8a8af933fc4fe83c0d"
        }
      ],
      "title": "RDMA/siw: Fix the sendmsg byte count in siw_tcp_sendpages",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-39758",
    "datePublished": "2025-09-11T16:52:27.598Z",
    "dateReserved": "2025-04-16T07:20:57.125Z",
    "dateUpdated": "2026-08-23T12:45:23.784Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-39758",
      "date": "2026-09-16",
      "epss": "0.00404",
      "percentile": "0.34219"
    },
    "microsoft_vex": {
      "current_release_date": "2025-09-13T01:01:56.000Z",
      "cve": "CVE-2025-39758",
      "id": "msrc_CVE-2025-39758",
      "initial_release_date": "2025-09-02T00:00:00.000Z",
      "product_status:fixed": "1",
      "product_status:known_affected": "1",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "RDMA/siw: Fix the sendmsg byte count in siw_tcp_sendpages",
      "url": "https://msrc.microsoft.com/csaf/vex/2025/msrc_cve-2025-39758.json",
      "version": "1"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-39758\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-09-11T17:15:39.663\",\"lastModified\":\"2026-08-23T13:16:26.380\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nRDMA/siw: Fix the sendmsg byte count in siw_tcp_sendpages\\n\\nEver since commit c2ff29e99a76 (\\\"siw: Inline do_tcp_sendpages()\\\"),\\nwe have been doing this:\\n\\nstatic int siw_tcp_sendpages(struct socket *s, struct page **page, int offset,\\n                             size_t size)\\n[...]\\n        /* Calculate the number of bytes we need to push, for this page\\n         * specifically */\\n        size_t bytes = min_t(size_t, PAGE_SIZE - offset, size);\\n        /* If we can\u0027t splice it, then copy it in, as normal */\\n        if (!sendpage_ok(page[i]))\\n                msg.msg_flags \u0026= ~MSG_SPLICE_PAGES;\\n        /* Set the bvec pointing to the page, with len $bytes */\\n        bvec_set_page(\u0026bvec, page[i], bytes, offset);\\n        /* Set the iter to $size, aka the size of the whole sendpages (!!!) */\\n        iov_iter_bvec(\u0026msg.msg_iter, ITER_SOURCE, \u0026bvec, 1, size);\\ntry_page_again:\\n        lock_sock(sk);\\n        /* Sendmsg with $size size (!!!) */\\n        rv = tcp_sendmsg_locked(sk, \u0026msg, size);\\n\\nThis means we\u0027ve been sending oversized iov_iters and tcp_sendmsg calls\\nfor a while. This has a been a benign bug because sendpage_ok() always\\nreturned true. With the recent slab allocator changes being slowly\\nintroduced into next (that disallow sendpage on large kmalloc\\nallocations), we have recently hit out-of-bounds crashes, due to slight\\ndifferences in iov_iter behavior between the MSG_SPLICE_PAGES and\\n\\\"regular\\\" copy paths:\\n\\n(MSG_SPLICE_PAGES)\\nskb_splice_from_iter\\n  iov_iter_extract_pages\\n    iov_iter_extract_bvec_pages\\n      uses i-\u003enr_segs to correctly stop in its tracks before OoB\u0027ing everywhere\\n  skb_splice_from_iter gets a \\\"short\\\" read\\n\\n(!MSG_SPLICE_PAGES)\\nskb_copy_to_page_nocache copy=iov_iter_count\\n [...]\\n   copy_from_iter\\n        /* this doesn\u0027t help */\\n        if (unlikely(iter-\u003ecount \u003c len))\\n                len = iter-\u003ecount;\\n          iterate_bvec\\n            ... and we run off the bvecs\\n\\nFix this by properly setting the iov_iter\u0027s byte count, plus sending the\\ncorrect byte count to tcp_sendmsg_locked.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/infiniband/sw/siw/siw_qp_tx.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"a19a58ab12695abb91a4e8ecf62cc0bc5badefbe\",\"lessThan\":\"b47c4b7cb78b6382c6d1af0bfc0d8218e4f445cc\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"c2ff29e99a764769eb2ce3a1a5585013633ee9a6\",\"lessThan\":\"5661fdd218c2799001b88c17acd19f4395e4488e\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"c2ff29e99a764769eb2ce3a1a5585013633ee9a6\",\"lessThan\":\"673cf582fd788af12cdacfb62a6a593083542481\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"c2ff29e99a764769eb2ce3a1a5585013633ee9a6\",\"lessThan\":\"42ebc16d9d2563f1a1ce0f05b643ee68d54fabf8\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"c2ff29e99a764769eb2ce3a1a5585013633ee9a6\",\"lessThan\":\"edf82bc8150570167a33a7d54627d66614cbf841\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"c2ff29e99a764769eb2ce3a1a5585013633ee9a6\",\"lessThan\":\"c18646248fed07683d4cee8a8af933fc4fe83c0d\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/infiniband/sw/siw/siw_qp_tx.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.5\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.5\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.103\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.43\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.15.11\",\"lessThanOrEqual\":\"6.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.16.2\",\"lessThanOrEqual\":\"6.16.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.17\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":9.8,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":5.9},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"NVD-CWE-noinfo\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.5\",\"versionEndExcluding\":\"6.6.103\",\"matchCriteriaId\":\"A0671C86-DE03-40C0-BDE5-B2242961ACA8\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.12.43\",\"matchCriteriaId\":\"472C5F87-2BF3-4FAB-9B21-DA7513977363\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.13\",\"versionEndExcluding\":\"6.15.11\",\"matchCriteriaId\":\"BC242347-F722-43AE-B910-BE0B22386977\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.16\",\"versionEndExcluding\":\"6.16.2\",\"matchCriteriaId\":\"BD7C087D-2415-4521-B624-30003352F899\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/42ebc16d9d2563f1a1ce0f05b643ee68d54fabf8\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/5661fdd218c2799001b88c17acd19f4395e4488e\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/673cf582fd788af12cdacfb62a6a593083542481\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/b47c4b7cb78b6382c6d1af0bfc0d8218e4f445cc\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/c18646248fed07683d4cee8a8af933fc4fe83c0d\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/edf82bc8150570167a33a7d54627d66614cbf841\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "None",
      "current_release_date": "2026-06-30T10:33:47+00:00",
      "cve": "CVE-2025-39758",
      "id": "CVE-2025-39758",
      "initial_release_date": "2025-09-11T00:00:00+00:00",
      "product_status:known_not_affected": "274",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: RDMA/siw: Fix the sendmsg byte count in siw_tcp_sendpages",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-39758.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-08-28T16:58:17Z",
      "cve": "CVE-2025-39758",
      "id": "CVE-2025-39758",
      "initial_release_date": "2025-09-11T23:24:12Z",
      "product_status:first_fixed": "2",
      "product_status:known_affected": "461",
      "product_status:known_not_affected": "320",
      "product_status:recommended": "464",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2025-39758",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2025-39758.json",
      "version": "48"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.