{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2025-39837", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2025-04-16T07:20:57.141Z", "datePublished": "2025-09-19T15:26:12.152Z", "dateUpdated": "2026-08-05T12:05:31.493Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:05:31.493Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nplatform/x86: asus-wmi: Fix racy registrations\n\nasus_wmi_register_driver() may be called from multiple drivers\nconcurrently, which can lead to the racy list operations, eventually\ncorrupting the memory and hitting Oops on some ASUS machines.\nAlso, the error handling is missing, and it forgot to unregister ACPI\nlps0 dev ops in the error case.\n\nThis patch covers those issues by introducing a simple mutex at\nacpi_wmi_register_driver() & *_unregister_driver, and adding the\nproper call of asus_s2idle_check_unregister() in the error path." } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:L - The defect lies in platform driver/module registration (`asus_wmi_register_driver`) and the ACPI s2idle suspend path on the local machine; there is no network-facing or remotely-reachable code path involved.\nAC:L - The attacker controls both sides of the race by concurrently loading asus-nb-wmi and eeepc-wmi, and the companion defect — the missing `asus_s2idle_check_unregister()` on the `asus_wmi_add()` error path — leaves a stale global list registration entirely deterministically, with no race to win at all.\nPR:L - On affected ASUS machines the racy double `list_add()` into `lps0_s2idle_devops_head` occurs unattended during boot-time udev module coldplug, requiring no attacker privilege to create; an ordinary unprivileged local-session user can then reach the corrupted list by requesting suspend via logind without any elevated capability.\nUI:N - No victim action is required — the corruption is produced by concurrent module autoloading at boot, and the corrupted list is traversed by any suspend, including automatic idle-timeout or lid-close s2idle entry.\nS:U - The corrupted global ACPI list, the stale driver registration and the resulting dangling function pointer all reside within the kernel's own security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - The double `list_add()` corrupts a global kernel list and leaves a stale registration pointing at a module-owned `acpi_s2idle_dev_ops` struct that can outlive asus-wmi.ko, so the freed/corrupted object can be reclaimed and read back through the s2idle handler chain, enabling disclosure of kernel memory.\nI:H - `list_add`/`list_del` on the doubly-linked node write attacker-influenceable pointers into adjacent kernel structures, and the stale registration yields a dangling `handler->restore()` function pointer invoked from `acpi_s2idle_restore_early_lps0()`, which is a control-flow hijack primitive after heap/module-memory reclamation.\nA:H - The self-referential list node turns `list_for_each_entry()` in the LPS0 prepare/check/restore paths into an infinite loop, hanging the machine during suspend, and the follow-up `list_del()` on the poisoned node produces a kernel Oops — exactly the memory corruption and Oops reported on real ASUS systems." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/platform/x86/asus-wmi.c" ], "versions": [ { "version": "feea7bd6b02d43a794e3f065650d89cf8d8e8e59", "lessThan": "e7a70326fb26b905cfc8fe2366113aa4394733ef", "status": "affected", "versionType": "git" }, { "version": "feea7bd6b02d43a794e3f065650d89cf8d8e8e59", "lessThan": "5549202b9c02c2ecbc8634768a3da8d9e82d548d", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/platform/x86/asus-wmi.c" ], "versions": [ { "version": "6.16", "status": "affected" }, { "version": "0", "lessThan": "6.16", "status": "unaffected", "versionType": "semver" }, { "version": "6.16.6", "lessThanOrEqual": "6.16.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.17", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.16", "versionEndExcluding": "6.16.6" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.16", "versionEndExcluding": "6.17" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/e7a70326fb26b905cfc8fe2366113aa4394733ef" }, { "url": "https://git.kernel.org/stable/c/5549202b9c02c2ecbc8634768a3da8d9e82d548d" } ], "title": "platform/x86: asus-wmi: Fix racy registrations", "x_generator": { "engine": "bippy-1.2.0" } }, "adp": [ { "metrics": [ { "cvssV3_1": { "scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH" } }, { "other": { "type": "ssvc", "content": { "id": "CVE-2025-39837", "role": "CISA Coordinator", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "total" } ], "version": "2.0.3", "timestamp": "2026-01-14T19:20:16.041958Z" } } } ], "problemTypes": [ { "descriptions": [ { "lang": "en", "type": "CWE", "cweId": "CWE-787", "description": "CWE-787 Out-of-bounds Write" } ] } ], "title": "CISA ADP Vulnrichment", "providerMetadata": { "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-14T19:23:12.029Z" } } ] } }