{"answers":{"affected":"It affects 1 product.","exploited":"There is no known exploitation of CVE-2025-39739 in the wild and no public exploit code.","fix":"Apply the vendor's patch.","what":"CVE-2025-39739 is a medium-severity vulnerability in Linux kernel, published on 11 Sep 2025. It can only be exploited from the same machine or local network, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2025-39739 and fix it if it is affected.\n\nWhat it is: CVE-2025-39739 is a medium-severity vulnerability in Linux kernel, published on 11 Sep 2025. It can only be exploited from the same machine or local network, with no action from the victim.\nExploitation: There is no known exploitation of CVE-2025-39739 in the wild and no public exploit code.\n\nAffected product: Linux kernel. No package-level version data is available, so check the vendor advisory linked from the reference page.\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2025-39739/ (Markdown: https://insights.sbomify.com/CVE-2025-39739/index.md)","id":"CVE-2025-39739","markdown":"https://insights.sbomify.com/CVE-2025-39739/index.md","name":"CVE-2025-39739","record":{"aliases":["AZL-67181","BELL-CVE-2025-39739","DEBIAN-CVE-2025-39739","GHSA-79cf-57gq-fhm9","ROOT-OS-UBUNTU-2404-CVE-2025-39739","UBUNTU-CVE-2025-39739"],"analysis":{"component_type":"kernel","fix_type":"patch","impacts":["denial_of_service"],"network_reachable":"adjacent_or_local","non_default_config":false,"product_category":"Linux kernel driver","requires_auth":"low_privilege","summary":"Missing hardware compatibility in the Qualcomm SMMU driver causes boot failures and GPU initialization errors on specific devices.","user_interaction":"not_required","vuln_class":"other"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"Linux","cpe":[{"product":"linux_kernel","vendor":"linux"}],"cvss":{"score":5.5,"severity":"medium","source":"nvd","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"cwes":[],"description":"In the Linux kernel, the following vulnerability has been resolved:\n\niommu/arm-smmu-qcom: Add SM6115 MDSS compatible\n\nAdd the SM6115 MDSS compatible to clients compatible list, as it also\nneeds that workaround.\nWithout this workaround, for example, QRB4210 RB2 which is based on\nSM4250/SM6115 generates a lot of smmu unhandled context faults during\nboot:\n\narm_smmu_context_fault: 116854 callbacks suppressed\narm-smmu c600000.iommu: Unhandled context fault: fsr=0x402,\niova=0x5c0ec600, fsynr=0x320021, cbfrsynra=0x420, cb=5\narm-smmu c600000.iommu: FSR    = 00000402 [Format=2 TF], SID=0x420\narm-smmu c600000.iommu: FSYNR0 = 00320021 [S1CBNDX=50 PNU PLVL=1]\narm-smmu c600000.iommu: Unhandled context fault: fsr=0x402,\niova=0x5c0d7800, fsynr=0x320021, cbfrsynra=0x420, cb=5\narm-smmu c600000.iommu: FSR    = 00000402 [Format=2 TF], SID=0x420\n\nand also failed initialisation of lontium lt9611uxc, gpu and dpu is\nobserved:\n(binding MDSS components triggered by lt9611uxc have failed)\n\n ------------[ cut here ]------------\n !aspace\n WARNING: CPU: 6 PID: 324 at drivers/gpu/drm/msm/msm_gem_vma.c:130 msm_gem_vma_init+0x150/0x18c [msm]\n Modules linked in: ... (long list of modules)\n CPU: 6 UID: 0 PID: 324 Comm: (udev-worker) Not tainted 6.15.0-03037-gaacc73ceeb8b #4 PREEMPT\n Hardware name: Qualcomm Technologies, Inc. QRB4210 RB2 (DT)\n pstate: 80000005 (Nzcv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--)\n pc : msm_gem_vma_init+0x150/0x18c [msm]\n lr : msm_gem_vma_init+0x150/0x18c [msm]\n sp : ffff80008144b280\n  \t\t...\n Call trace:\n  msm_gem_vma_init+0x150/0x18c [msm] (P)\n  get_vma_locked+0xc0/0x194 [msm]\n  msm_gem_get_and_pin_iova_range+0x4c/0xdc [msm]\n  msm_gem_kernel_new+0x48/0x160 [msm]\n  msm_gpu_init+0x34c/0x53c [msm]\n  adreno_gpu_init+0x1b0/0x2d8 [msm]\n  a6xx_gpu_init+0x1e8/0x9e0 [msm]\n  adreno_bind+0x2b8/0x348 [msm]\n  component_bind_all+0x100/0x230\n  msm_drm_bind+0x13c/0x3d0 [msm]\n  try_to_bring_up_aggregate_device+0x164/0x1d0\n  __component_add+0xa4/0x174\n  component_add+0x14/0x20\n  dsi_dev_attach+0x20/0x34 [msm]\n  dsi_host_attach+0x58/0x98 [msm]\n  devm_mipi_dsi_attach+0x34/0x90\n  lt9611uxc_attach_dsi.isra.0+0x94/0x124 [lontium_lt9611uxc]\n  lt9611uxc_probe+0x540/0x5fc [lontium_lt9611uxc]\n  i2c_device_probe+0x148/0x2a8\n  really_probe+0xbc/0x2c0\n  __driver_probe_device+0x78/0x120\n  driver_probe_device+0x3c/0x154\n  __driver_attach+0x90/0x1a0\n  bus_for_each_dev+0x68/0xb8\n  driver_attach+0x24/0x30\n  bus_add_driver+0xe4/0x208\n  driver_register+0x68/0x124\n  i2c_register_driver+0x48/0xcc\n  lt9611uxc_driver_init+0x20/0x1000 [lontium_lt9611uxc]\n  do_one_initcall+0x60/0x1d4\n  do_init_module+0x54/0x1fc\n  load_module+0x1748/0x1c8c\n  init_module_from_file+0x74/0xa0\n  __arm64_sys_finit_module+0x130/0x2f8\n  invoke_syscall+0x48/0x104\n  el0_svc_common.constprop.0+0xc0/0xe0\n  do_el0_svc+0x1c/0x28\n  el0_svc+0x2c/0x80\n  el0t_64_sync_handler+0x10c/0x138\n  el0t_64_sync+0x198/0x19c\n ---[ end trace 0000000000000000 ]---\n msm_dpu 5e01000.display-controller: [drm:msm_gpu_init [msm]] *ERROR* could not allocate memptrs: -22\n msm_dpu 5e01000.display-controller: failed to load adreno gpu\n platform a400000.remoteproc:glink-edge:apr:service@7:dais: Adding to iommu group 19\n msm_dpu 5e01000.display-controller: failed to bind 5900000.gpu (ops a3xx_ops [msm]): -22\n msm_dpu 5e01000.display-controller: adev bind failed: -22\n lt9611uxc 0-002b: failed to attach dsi to host\n lt9611uxc 0-002b: probe with driver lt9611uxc failed with error -22","ecosystems":[],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":true,"headline":"iommu/arm-smmu-qcom: Add SM6115 MDSS compatible","id":"CVE-2025-39739","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":null,"product":"linux:linux_kernel","products":["linux:linux_kernel"],"type":"other","year":"2025"},"n_packages":0,"n_references":5,"next":{"headline":"drm/xe/migrate: prevent potential UAF","id":"CVE-2025-39740"},"packages":[],"prev":{"headline":"btrfs: do not allow relocation of partially dropped subvolumes","id":"CVE-2025-39738"},"products":["Linux"],"published":"2025-09-11","related":[{"cvss_score":8.8,"headline":"Linux Kernel Out-of-Bounds Write","id":"CVE-2026-53266","kev_date_added":"2026-09-18","published":"2026-06-25"},{"cvss_score":8.8,"headline":"Linux Kernel Improper Input Validation","id":"CVE-2013-6282","kev_date_added":"2022-09-15","published":"2013-11-19"},{"cvss_score":8.4,"headline":"Linux Kernel Heap-Based Buffer Overflow","id":"CVE-2022-0185","kev_date_added":"2024-08-21","published":"2022-02-11"},{"cvss_score":8.4,"headline":"Linux Kernel Privilege Escalation","id":"CVE-2013-2094","kev_date_added":"2022-09-15","published":"2013-05-14"},{"cvss_score":7.8,"headline":"Linux Kernel Unspecified","id":"CVE-2026-53362","kev_date_added":"2026-08-27","published":"2026-07-04"},{"cvss_score":7.8,"headline":"Linux Kernel Missing Initialization of a Variable","id":"CVE-2026-46300","kev_date_added":"2026-10-28","published":"2026-05-23"},{"cvss_score":7.8,"headline":"Linux Kernel Race Condition","id":"CVE-2025-39964","kev_date_added":"2026-09-18","published":"2025-10-13"}],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"US public information, NVD API terms","name":"NVD"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":"PUBLISHED","updated":"2026-05-11","vendors":["Linux"]},"summary":"Missing hardware compatibility in the Qualcomm SMMU driver causes boot failures and GPU initialization errors on specific devices.","url":"https://insights.sbomify.com/CVE-2025-39739/"}