CVE & CISA-KEV Catalog

CVE-2025-39809

HIGH
7.8
CVSS v3
NVD

Description

In the Linux kernel, the following vulnerability has been resolved: HID: intel-thc-hid: intel-quicki2c: Fix ACPI dsd ICRS/ISUB length The QuickI2C ACPI _DSD methods return ICRS and ISUB data with a trailing byte, making the actual length is one more byte than the structs defined. It caused stack-out-of-bounds and kernel crash: kernel: BUG: KASAN: stack-out-of-bounds in quicki2c_acpi_get_dsd_property.constprop.0+0x111/0x1b0 [intel_quicki2c] kernel: Write of size 12 at addr ffff888106d1f900 by task kworker/u33:2/75 kernel: kernel: CPU: 3 UID: 0 PID: 75 Comm: kworker/u33:2 Not tainted 6.16.0+ #3 PREEMPT(voluntary) kernel: Workqueue: async async_run_entry_fn kernel: Call Trace: kernel: <TASK> kernel: dump_stack_lvl+0x76/0xa0 kernel: print_report+0xd1/0x660 kernel: ? __pfx__raw_spin_lock_irqsave+0x10/0x10 kernel: ? __kasan_slab_free+0x5d/0x80 kernel: ? kasan_addr_to_slab+0xd/0xb0 kernel: kasan_report+0xe1/0x120 kernel: ? quicki2c_acpi_get_dsd_property.constprop.0+0x111/0x1b0 [intel_quicki2c] kernel: ? quicki2c_acpi_get_dsd_property.constprop.0+0x111/0x1b0 [intel_quicki2c] kernel: kasan_check_range+0x11c/0x200 kernel: __asan_memcpy+0x3b/0x80 kernel: quicki2c_acpi_get_dsd_property.constprop.0+0x111/0x1b0 [intel_quicki2c] kernel: ? __pfx_quicki2c_acpi_get_dsd_property.constprop.0+0x10/0x10 [intel_quicki2c] kernel: quicki2c_get_acpi_resources+0x237/0x730 [intel_quicki2c] [...] kernel: </TASK> kernel: kernel: The buggy address belongs to stack of task kworker/u33:2/75 kernel: and is located at offset 48 in frame: kernel: quicki2c_get_acpi_resources+0x0/0x730 [intel_quicki2c] kernel: kernel: This frame has 3 objects: kernel: [32, 36) 'hid_desc_addr' kernel: [48, 59) 'i2c_param' kernel: [80, 224) 'i2c_config' ACPI DSD methods return: \_SB.PC00.THC0.ICRS Buffer 000000003fdc947b 001 Len 0C = 0A 00 80 1A 06 00 00 00 00 00 00 00 \_SB.PC00.THC0.ISUB Buffer 00000000f2fcbdc4 001 Len 91 = 00 00 00 00 00 00 00 00 00 00 00 00 Adding reserved padding to quicki2c_subip_acpi_parameter/config.

How to fix

Remediation Available
linuxDebian
Fixed in:6.16.5-1CVE-2025-39809
linux-aws-6.14Ubuntu
Fixed in:6.14.0-1017.17~24.04.1USN-7879-3
linux-azure-6.14Ubuntu
Fixed in:6.14.0-1017.17~24.04.1USN-7934-1
linux-gcp-6.14Ubuntu
Fixed in:6.14.0-1020.21~24.04.1USN-7879-4
linux-hwe-6.14Ubuntu
Fixed in:6.14.0-36.36~24.04.1USN-7879-1
linux-image-6.14.0-1016-realtimeUbuntu
Fixed in:6.14.0-1016.16~24.04.1USN-7879-2
linux-image-6.14.0-1017-awsUbuntu
Fixed in:6.14.0-1017.17~24.04.1USN-7879-3
linux-image-6.14.0-1017-aws-64kUbuntu
Fixed in:6.14.0-1017.17~24.04.1USN-7879-3
linux-image-6.14.0-1017-azureUbuntu
Fixed in:6.14.0-1017.17~24.04.1USN-7934-1
linux-image-6.14.0-1017-oracleUbuntu
Fixed in:6.14.0-1017.17~24.04.1USN-7879-3
linux-image-6.14.0-1017-oracle-64kUbuntu
Fixed in:6.14.0-1017.17~24.04.1USN-7879-3
linux-image-6.14.0-1020-gcpUbuntu
Fixed in:6.14.0-1020.21~24.04.1USN-7879-4
linux-image-6.14.0-1020-gcp-64kUbuntu
Fixed in:6.14.0-1020.21~24.04.1USN-7879-4
linux-image-6.14.0-36-genericUbuntu
Fixed in:6.14.0-36.36~24.04.1USN-7879-1
linux-image-6.14.0-36-generic-64kUbuntu
Fixed in:6.14.0-36.36~24.04.1USN-7879-1
linux-image-awsUbuntu
Fixed in:6.14.0-1017.17~24.04.1USN-7879-3
linux-image-aws-6.14Ubuntu
Fixed in:6.14.0-1017.17~24.04.1USN-7879-3
linux-image-aws-64kUbuntu
Fixed in:6.14.0-1017.17~24.04.1USN-7879-3
linux-image-aws-64k-6.14Ubuntu
Fixed in:6.14.0-1017.17~24.04.1USN-7879-3
linux-image-azureUbuntu
Fixed in:6.14.0-1017.17~24.04.1USN-7934-1
linux-image-azure-6.14Ubuntu
Fixed in:6.14.0-1017.17~24.04.1USN-7934-1
linux-image-gcpUbuntu
Fixed in:6.14.0-1020.21~24.04.1USN-7879-4
linux-image-gcp-6.14Ubuntu
Fixed in:6.14.0-1020.21~24.04.1USN-7879-4
linux-image-gcp-64kUbuntu
Fixed in:6.14.0-1020.21~24.04.1USN-7879-4
linux-image-gcp-64k-6.14Ubuntu
Fixed in:6.14.0-1020.21~24.04.1USN-7879-4
linux-image-generic-6.14Ubuntu
Fixed in:6.14.0-36.36~24.04.1USN-7879-1
linux-image-generic-64k-6.14Ubuntu
Fixed in:6.14.0-36.36~24.04.1USN-7879-1
linux-image-generic-64k-hwe-24.04Ubuntu
Fixed in:6.14.0-36.36~24.04.1USN-7879-1
linux-image-generic-hwe-24.04Ubuntu
Fixed in:6.14.0-36.36~24.04.1USN-7879-1
linux-image-oracleUbuntu
Fixed in:6.14.0-1017.17~24.04.1USN-7879-3
linux-image-oracle-6.14Ubuntu
Fixed in:6.14.0-1017.17~24.04.1USN-7879-3
linux-image-oracle-64kUbuntu
Fixed in:6.14.0-1017.17~24.04.1USN-7879-3
linux-image-oracle-64k-6.14Ubuntu
Fixed in:6.14.0-1017.17~24.04.1USN-7879-3
linux-image-realtime-6.14Ubuntu
Fixed in:6.14.0-1016.16~24.04.1USN-7879-2
linux-image-realtime-hwe-24.04Ubuntu
Fixed in:6.14.0-1016.16~24.04.1USN-7879-2
linux-image-virtual-6.14Ubuntu
Fixed in:6.14.0-36.36~24.04.1USN-7879-1
linux-image-virtual-hwe-24.04Ubuntu
Fixed in:6.14.0-36.36~24.04.1USN-7879-1
linux-oracle-6.14Ubuntu
Fixed in:6.14.0-1017.17~24.04.1USN-7879-3
linux-realtime-6.14Ubuntu
Fixed in:6.14.0-1016.16~24.04.1USN-7879-2

Remediation is compiled from vendor and distribution security advisories. Always confirm against the linked source for your exact version and platform.

CVSS v3 Vector

Exploitability

Attack VectorLocal
Attack ComplexityLow
Privileges RequiredLow
User InteractionNone
ScopeUnchanged

Impact

ConfidentialityHigh
IntegrityHigh
AvailabilityHigh

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Exploit Intelligence

0.14%probability of exploitation in 30 days
4thpercentile

Low risk: more likely to be exploited than 4% of all known CVEs.

References

Related Vulnerabilities

Other CWE-787 (Out-of-bounds Write) vulnerabilities, ordered by exploit likelihood. View all

CVESeverityCVSSEPSSExploitedFix
CVE-2025-22457Critical9.0100%KEV + RansomFix
CVE-2025-0282Critical9.0100%KEV + Ransom-
CVE-2015-3113Critical9.8100%KEVFix
CVE-2021-20038Critical9.8100%KEV + Ransom-
CVE-2023-4863High8.8100%KEVFix
CVE-2020-16040Medium6.5100%-Fix
Embed a live status badge for CVE-2025-39809
CVE-2025-39809 severity badge

Markdown

[![CVE-2025-39809](https://tridentstack.com/cve/badge/CVE-2025-39809.svg)](https://tridentstack.com/cve/CVE-2025-39809)

HTML

<a href="https://tridentstack.com/cve/CVE-2025-39809"><img src="https://tridentstack.com/cve/badge/CVE-2025-39809.svg" alt="CVE-2025-39809"></a>

Find and fix vulnerabilities across your fleet

TridentStack Control continuously scans your Windows, macOS, and Linux fleet for known vulnerabilities, prioritizes them by severity and active exploitation, and patches them automatically.

Start free

This product uses NVD data but is not endorsed or certified by the NVD. EPSS scores courtesy of FIRST.org (https://www.first.org/epss). Source: CISA KEV Catalog. Data as of 2026-01-14.