CVE-2025-39939 iommu/s390: Fix memory corruption when using identity domain
A memory corruption vulnerability in the Linux kernel's s390 IOMMU driver allows attackers to cause denial of service or potentially execute code when using identity domains.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-39939?
CVE-2025-39939 is a high-severity memory corruption vulnerability in Linux kernel, published on 4 Oct 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
iommu/s390: Fix memory corruption when using identity domain
zpci_get_iommu_ctrs() returns counter information to be reported as part of device statistics; these counters are stored as part of the s390_domain. The problem, however, is that the identity domain is not backed by an s390_domain and so the conversion via to_s390_domain() yields a bad address that is zero'd initially and read on-demand later via a sysfs read. These counters aren't necessary for the identity domain; just return NULL in this case.
This issue was discovered via KASAN with reports that look like: BUG: KASAN: global-out-of-bounds in zpci_fmb_enable_device when using the identity domain for a device on s390.
Weakness: CWE-787
Which versions are affected by CVE-2025-39939?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2025-39939?
Apply the vendor's patch.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2025-39939 being exploited?
There is no known exploitation of CVE-2025-39939 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as BELL-CVE-2025-39939, DEBIAN-CVE-2025-39939, GHSA-pm9c-rrjm-4v2f, UBUNTU-CVE-2025-39939.