{"id":"CVE-2025-39939","revision":"f8ed24b6e59f4d42a0f3b3f5cc20491a","records":[{"revision":"f8ed24b6e59f4d42a0f3b3f5cc20491a","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2025-39939","aliases":[],"title":"iommu/s390: Fix memory corruption when using identity domain","description":"In the Linux kernel, the following vulnerability has been resolved:\n\niommu/s390: Fix memory corruption when using identity domain\n\nzpci_get_iommu_ctrs() returns counter information to be reported as part\nof device statistics; these counters are stored as part of the s390_domain.\nThe problem, however, is that the identity domain is not backed by an\ns390_domain and so the conversion via to_s390_domain() yields a bad address\nthat is zero'd initially and read on-demand later via a sysfs read.\nThese counters aren't necessary for the identity domain; just return NULL\nin this case.\n\nThis issue was discovered via KASAN with reports that look like:\nBUG: KASAN: global-out-of-bounds in zpci_fmb_enable_device\nwhen using the identity domain for a device on s390.","state":0,"publishedAt":"2025-10-04T07:31:02.521+00:00","modifiedAt":"2026-10-15T22:02:33.574+00:00","affected":[{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"drivers/iommu/s390-iommu.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"64af12c6ec3afd7d44bc8b2044eee59f98059087\",\n                            \"lessThan\": \"17a58caf3863163c4a84a218a9649be2c8061443\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"64af12c6ec3afd7d44bc8b2044eee59f98059087\",\n                            \"lessThan\": \"b3506e9bcc777ed6af2ab631c86a9990ed97b474\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"affected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"drivers/iommu/s390-iommu.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"6.15\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"0\",\n                            \"lessThan\": \"6.15\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.16.9\",\n                            \"lessThanOrEqual\": \"6.16.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.17\",\n                            \"lessThanOrEqual\": \"*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"original_commit_for_fix\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","score":7.8,"severity":"HIGH"}],"references":["https://git.kernel.org/stable/c/17a58caf3863163c4a84a218a9649be2c8061443","https://git.kernel.org/stable/c/b3506e9bcc777ed6af2ab631c86a9990ed97b474"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2025-39939","license":"CVE Program Terms of Use","key":"cve-program:CVE-2025-39939","identifiers":["CVE-2025-39939"]},"retained":false,"historicalAffected":[]}],"coverage":[]}