CVE-2025-39882

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-39882", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2025-04-16T07:20:57.144Z", "datePublished": "2025-09-23T06:00:51.036Z", "dateUpdated": "2026-08-05T12:05:53.126Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:05:53.126Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/mediatek: fix potential OF node use-after-free\n\nThe for_each_child_of_node() helper drops the reference it takes to each\nnode as it iterates over children and an explicit of_node_put() is only\nneeded when exiting the loop early.\n\nDrop the recently introduced bogus additional reference count decrement\nat each iteration that could potentially lead to a use-after-free."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 8.4, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - `mtk_drm_get_all_drm_priv()` is reached only through the local driver model \u2014 boot-time component bind from `mtk_drm_probe()`/`component_master_add_with_match()`, deferred-probe retries, sysfs bind/unbind of `mediatek-drm`, or module load/unload; there is no network, adjacent-network, or physical path, and leveraging the released `device_node` requires a local heap spray in the same kmalloc cache.\nAC:L - The extra `of_node_put()` at the `next_put_node:` label is unconditional \u2014 every path in the loop body falls through to it, so all 221 `/soc` children lose a reference on every single call, with no race to win and no memory-layout precondition. On mt8195/mt8188 (`mmsys_dev_num == 2`) the loop runs at least twice per boot, and bind/unbind cycles reproduce it deterministically at will.\nPR:N - No credential, capability, or namespace check exists anywhere on the path \u2014 the references are dropped by the kernel's own component-bind machinery at boot, before any user session exists, so the underflowed/released `device_node` state is reached with zero privileges. Deliberate re-triggering via sysfs unbind would need root, but that is not required for the vulnerable condition to arise (same basis as CVE-2025-39930 for this identical bug class).\nUI:N - The MediaTek DRM component master binds automatically once its device-tree components probe, and deferred-probe retries run unattended at boot; no administrator, victim action, mount, or file open is needed for the extra `of_node_put()` to fire.\nS:U - The corrupted `struct device_node`, its embedded kobject, and the OF tree all belong to the kernel's own security authority, and the faulting code executes in that same kernel context. No hypervisor, IOMMU, or sandbox boundary is crossed.\nC:H - This is a premature release/use-after-free of `device_node` objects that remain reachable through the OF tree, `dev->of_node`, and phandle lookups; `kobject_cleanup()` `kfree_const()`s `kobj->name` while leaving the pointer live, and once the slab is reclaimed `of_property_read_*()`, `%pOF` on `full_name`, and `kobject_name()` read back attacker-sprayed heap contents \u2014 while the `bad of_node_put()` splat plus `dump_stack()` already leaks kernel pointers and a full stack trace.\nI:H - A reclaimed `device_node` yields a control-flow hijack primitive via the embedded `fwnode_handle.ops` table dereferenced by `fwnode_call_int_op()` and via `kobj.ktype->release` invoked on the next `of_node_put()`, and the `parent`/`child`/`sibling` links plus device-link `suppliers`/`consumers` list heads give arbitrary-write through list manipulation during tree operations.\nA:H - Each boot produces \"ERROR: detected bad of_node_put()\" with `dump_stack()` followed by `refcount_t: underflow; use-after-free` WARNs \u2014 an outright panic under `panic_on_warn` \u2014 while `__kobject_del()` tears down `/sys/firmware/devicetree/base` entries and cascades puts onto the `/soc` node, and dereferencing a released node oopses the kernel with display bring-up failing outright."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/gpu/drm/mediatek/mtk_drm_drv.c"], "versions": [{"version": "7d98166183d627c0b9daca7672b2191fae0f8a03", "lessThan": "b2fbe0f9f80b9cfa1e06ddcf8b863d918394ef1d", "status": "affected", "versionType": "git"}, {"version": "31ce7c089b50c3d3056c37e0e25e7535e4428ae1", "lessThan": "b58a26cdd4795c1ce6a80e38e9348885555dacd6", "status": "affected", "versionType": "git"}, {"version": "fae58d0155a979a8c414bbc12db09dd4b2f910d0", "lessThan": "c4901802ed1ce859242e10af06e6a7752cba0497", "status": "affected", "versionType": "git"}, {"version": "1f403699c40f0806a707a9a6eed3b8904224021a", "lessThan": "4de37a48b6b58faaded9eb765047cf0d8785ea18", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/gpu/drm/mediatek/mtk_drm_drv.c"], "versions": [{"version": "6.6.105", "lessThan": "6.6.107", "status": "affected", "versionType": "semver"}, {"version": "6.12.45", "lessThan": "6.12.48", "status": "affected", "versionType": "semver"}, {"version": "6.16.5", "lessThan": "6.16.8", "status": "affected", "versionType": "semver"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.6.105", "versionEndExcluding": "6.6.107"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.12.45", "versionEndExcluding": "6.12.48"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.16.5", "versionEndExcluding": "6.16.8"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/b2fbe0f9f80b9cfa1e06ddcf8b863d918394ef1d"}, {"url": "https://git.kernel.org/stable/c/b58a26cdd4795c1ce6a80e38e9348885555dacd6"}, {"url": "https://git.kernel.org/stable/c/c4901802ed1ce859242e10af06e6a7752cba0497"}, {"url": "https://git.kernel.org/stable/c/4de37a48b6b58faaded9eb765047cf0d8785ea18"}], "title": "drm/mediatek: fix potential OF node use-after-free", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2025-39882", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-01-14T19:25:43.286538Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-416", "description": "CWE-416 Use After Free"}]}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-14T19:33:12.579Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2025-39882", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-01-14T19:25:43.286538Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-416", "description": "CWE-416 Use After Free"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-14T19:25:37.870Z"}}], "cna": {"title": "drm/mediatek: fix potential OF node use-after-free", "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 8.4, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}, "scenarios": [{"lang": "en", "value": "AV:L - `mtk_drm_get_all_drm_priv()` is reached only through the local driver model \u2014 boot-time component bind from `mtk_drm_probe()`/`component_master_add_with_match()`, deferred-probe retries, sysfs bind/unbind of `mediatek-drm`, or module load/unload; there is no network, adjacent-network, or physical path, and leveraging the released `device_node` requires a local heap spray in the same kmalloc cache.\nAC:L - The extra `of_node_put()` at the `next_put_node:` label is unconditional \u2014 every path in the loop body falls through to it, so all 221 `/soc` children lose a reference on every single call, with no race to win and no memory-layout precondition. On mt8195/mt8188 (`mmsys_dev_num == 2`) the loop runs at least twice per boot, and bind/unbind cycles reproduce it deterministically at will.\nPR:N - No credential, capability, or namespace check exists anywhere on the path \u2014 the references are dropped by the kernel's own component-bind machinery at boot, before any user session exists, so the underflowed/released `device_node` state is reached with zero privileges. Deliberate re-triggering via sysfs unbind would need root, but that is not required for the vulnerable condition to arise (same basis as CVE-2025-39930 for this identical bug class).\nUI:N - The MediaTek DRM component master binds automatically once its device-tree components probe, and deferred-probe retries run unattended at boot; no administrator, victim action, mount, or file open is needed for the extra `of_node_put()` to fire.\nS:U - The corrupted `struct device_node`, its embedded kobject, and the OF tree all belong to the kernel's own security authority, and the faulting code executes in that same kernel context. No hypervisor, IOMMU, or sandbox boundary is crossed.\nC:H - This is a premature release/use-after-free of `device_node` objects that remain reachable through the OF tree, `dev->of_node`, and phandle lookups; `kobject_cleanup()` `kfree_const()`s `kobj->name` while leaving the pointer live, and once the slab is reclaimed `of_property_read_*()`, `%pOF` on `full_name`, and `kobject_name()` read back attacker-sprayed heap contents \u2014 while the `bad of_node_put()` splat plus `dump_stack()` already leaks kernel pointers and a full stack trace.\nI:H - A reclaimed `device_node` yields a control-flow hijack primitive via the embedded `fwnode_handle.ops` table dereferenced by `fwnode_call_int_op()` and via `kobj.ktype->release` invoked on the next `of_node_put()`, and the `parent`/`child`/`sibling` links plus device-link `suppliers`/`consumers` list heads give arbitrary-write through list manipulation during tree operations.\nA:H - Each boot produces \"ERROR: detected bad of_node_put()\" with `dump_stack()` followed by `refcount_t: underflow; use-after-free` WARNs \u2014 an outright panic under `panic_on_warn` \u2014 while `__kobject_del()` tears down `/sys/firmware/devicetree/base` entries and cascades puts onto the `/soc` node, and dereferencing a released node oopses the kernel with display bring-up failing outright."}]}], "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "7d98166183d627c0b9daca7672b2191fae0f8a03", "lessThan": "b2fbe0f9f80b9cfa1e06ddcf8b863d918394ef1d", "versionType": "git"}, {"status": "affected", "version": "31ce7c089b50c3d3056c37e0e25e7535e4428ae1", "lessThan": "b58a26cdd4795c1ce6a80e38e9348885555dacd6", "versionType": "git"}, {"status": "affected", "version": "fae58d0155a979a8c414bbc12db09dd4b2f910d0", "lessThan": "c4901802ed1ce859242e10af06e6a7752cba0497", "versionType": "git"}, {"status": "affected", "version": "1f403699c40f0806a707a9a6eed3b8904224021a", "lessThan": "4de37a48b6b58faaded9eb765047cf0d8785ea18", "versionType": "git"}], "programFiles": ["drivers/gpu/drm/mediatek/mtk_drm_drv.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "6.6.105", "lessThan": "6.6.107", "versionType": "semver"}, {"status": "affected", "version": "6.12.45", "lessThan": "6.12.48", "versionType": "semver"}, {"status": "affected", "version": "6.16.5", "lessThan": "6.16.8", "versionType": "semver"}], "programFiles": ["drivers/gpu/drm/mediatek/mtk_drm_drv.c"], "defaultStatus": "unaffected"}], "references": [{"url": "https://git.kernel.org/stable/c/b2fbe0f9f80b9cfa1e06ddcf8b863d918394ef1d"}, {"url": "https://git.kernel.org/stable/c/b58a26cdd4795c1ce6a80e38e9348885555dacd6"}, {"url": "https://git.kernel.org/stable/c/c4901802ed1ce859242e10af06e6a7752cba0497"}, {"url": "https://git.kernel.org/stable/c/4de37a48b6b58faaded9eb765047cf0d8785ea18"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/mediatek: fix potential OF node use-after-free\n\nThe for_each_child_of_node() helper drops the reference it takes to each\nnode as it iterates over children and an explicit of_node_put() is only\nneeded when exiting the loop early.\n\nDrop the recently introduced bogus additional reference count decrement\nat each iteration that could potentially lead to a use-after-free."}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.6.107", "versionStartIncluding": "6.6.105"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.12.48", "versionStartIncluding": "6.12.45"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.16.8", "versionStartIncluding": "6.16.5"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:05:53.126Z"}}}, "cveMetadata": {"cveId": "CVE-2025-39882", "state": "PUBLISHED", "dateUpdated": "2026-08-05T12:05:53.126Z", "dateReserved": "2025-04-16T07:20:57.144Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2025-09-23T06:00:51.036Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/gpu/drm/mediatek/mtk_drm_drv.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "b2fbe0f9f80b9cfa1e06ddcf8b863d918394ef1d", "status": "affected", "version": "7d98166183d627c0b9daca7672b2191fae0f8a03", "versionType": "git"}, {"lessThan": "b58a26cdd4795c1ce6a80e38e9348885555dacd6", "status": "affected", "version": "31ce7c089b50c3d3056c37e0e25e7535e4428ae1", "versionType": "git"}, {"lessThan": "c4901802ed1ce859242e10af06e6a7752cba0497", "status": "affected", "version": "fae58d0155a979a8c414bbc12db09dd4b2f910d0", "versionType": "git"}, {"lessThan": "4de37a48b6b58faaded9eb765047cf0d8785ea18", "status": "affected", "version": "1f403699c40f0806a707a9a6eed3b8904224021a", "versionType": "git"}]}, {"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/gpu/drm/mediatek/mtk_drm_drv.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "6.6.107", "status": "affected", "version": "6.6.105", "versionType": "semver"}, {"lessThan": "6.12.48", "status": "affected", "version": "6.12.45", "versionType": "semver"}, {"lessThan": "6.16.8", "status": "affected", "version": "6.16.5", "versionType": "semver"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "C7059167-0B11-467C-9F6D-8222BB30F40A", "versionEndExcluding": "6.6.107", "versionStartIncluding": "6.6.105", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "4834C96E-5049-4D95-B247-49C037F71647", "versionEndExcluding": "6.12.48", "versionStartIncluding": "6.12.45", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "EEAC17D4-932B-4C5C-A1F8-E6FB83B9580F", "versionEndExcluding": "6.16.8", "versionStartIncluding": "6.16.5", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.17:rc4:*:*:*:*:*:*", "matchCriteriaId": "340BEEA9-D70D-4290-B502-FBB1032353B1", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.17:rc5:*:*:*:*:*:*", "matchCriteriaId": "47E4C5C0-079F-4838-971B-8C503D48FCC2", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/mediatek: fix potential OF node use-after-free\n\nThe for_each_child_of_node() helper drops the reference it takes to each\nnode as it iterates over children and an explicit of_node_put() is only\nneeded when exiting the loop early.\n\nDrop the recently introduced bogus additional reference count decrement\nat each iteration that could potentially lead to a use-after-free."}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\ndrm/mediatek: corrige potencial uso despu\u00e9s de liberaci\u00f3n de nodo OF\n\nLa funci\u00f3n auxiliar for_each_child_of_node() libera la referencia que toma a cada nodo mientras itera sobre los hijos y una llamada expl\u00edcita a of_node_put() solo es necesaria al salir del bucle prematuramente.\n\nEliminar el recientemente introducido decremento adicional err\u00f3neo del contador de referencias en cada iteraci\u00f3n que podr\u00eda conducir potencialmente a un uso despu\u00e9s de liberaci\u00f3n."}], "id": "CVE-2025-39882", "lastModified": "2026-10-19T21:10:00.160", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 8.4, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.5, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-39882", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-01-14T19:25:43.286538Z", "version": "2.0.3"}}]}, "published": "2025-09-23T06:15:47.947", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/4de37a48b6b58faaded9eb765047cf0d8785ea18"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/b2fbe0f9f80b9cfa1e06ddcf8b863d918394ef1d"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/b58a26cdd4795c1ce6a80e38e9348885555dacd6"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/c4901802ed1ce859242e10af06e6a7752cba0497"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-416"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-416"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{"bugzilla": {"description": "kernel: drm/mediatek: fix potential OF node use-after-free", "id": "2397560", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2397560"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "details": ["No description is available for this CVE."], "name": "CVE-2025-39882", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2025-09-23T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2025-39882\nhttps://nvd.nist.gov/vuln/detail/CVE-2025-39882\nhttps://lore.kernel.org/linux-cve-announce/2025092301-CVE-2025-39882-1d0a@gregkh/T"], "threat_severity": "Moderate"}

{"created": "2025-09-23T16:03:15.356500+00:00", "updated": "2025-09-23T16:03:15.356565+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}