CVE-2025-39787

EUVD-2025-28926

11.09.2025, 17:15

In the Linux kernel, the following vulnerability has been resolved:

soc: qcom: mdt_loader: Ensure we don't read past the ELF header

When the MDT loader is used in remoteproc, the ELF header is sanitized
beforehand, but that's not necessary the case for other clients.

Validate the size of the firmware buffer to ensure that we don't read
past the end as we iterate over the header. e_phentsize and e_shentsize
are validated as well, to ensure that the assumptions about step size in
the traversal are valid.

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
siemens-SADP	ADP	5.5 MEDIUM	LOCAL	LOW	LOW	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Base Score

CVSS 3.x

EPSS Score

Percentile: 4%

Affected Products (NVD)

Vendor	Product	Version
linux	linux_kernel	4.11 ≤ 𝑥 < 5.4.297
linux	linux_kernel	5.5 ≤ 𝑥 < 5.10.241
linux	linux_kernel	5.11 ≤ 𝑥 < 5.15.190
linux	linux_kernel	5.16 ≤ 𝑥 < 6.1.149
linux	linux_kernel	6.2 ≤ 𝑥 < 6.6.103
linux	linux_kernel	6.7 ≤ 𝑥 < 6.12.44
linux	linux_kernel	6.13 ≤ 𝑥 < 6.16.4
debian	debian_linux	11.0

𝑥

= Vulnerable software versions

Early Detection

Affected products identified ahead of NVD analysis through intelligence sources.

Vendor	Product	Version	Source
Siemens	SIMATIC CN 4100	𝑥 < V5.0	ADP
Siemens	SIMATIC S7-1500 CPU 1518-4 PN\/DP MFP	V3.1.5 ≤ 𝑥 < *	ADP
Siemens	SIMATIC S7-1500 CPU 1518-4 PN\/DP MFP	V3.1.5 ≤ 𝑥 < *	ADP
Siemens	SIMATIC S7-1500 CPU 1518F-4 PN\/DP MFP	V3.1.5 ≤ 𝑥 < *	ADP
Siemens	SIMATIC S7-1500 CPU 1518F-4 PN\/DP MFP	V3.1.5 ≤ 𝑥 < *	ADP
Siemens	SIPLUS S7-1500 CPU 1518-4 PN\/DP MFP	V3.1.5 ≤ 𝑥 < *	ADP
siemens	simatic_cn_4100	𝑥 < 5.0	ADP

Debian Releases

Debian Product

Codename

linux

bookworm	6.1.170-3 fixed
bookworm (security)	6.1.172-1 fixed
bullseye	vulnerable
bullseye (security)	5.10.251-5 fixed
forky	7.0.7-1 fixed
sid	7.0.7-1 fixed
trixie	6.12.86-1 fixed
trixie (security)	6.12.88-1 fixed

linux-6.1

bullseye (security)

6.1.172-1~deb11u1

fixed

openSUSE / SLES Releases

openSUSE Product

Release

cluster-md-kmp-default

suse enterprise server 12 SP5

4.12.14-122.275.1

fixed

dlm-kmp-default

suse enterprise server 12 SP5

4.12.14-122.275.1

fixed

gfs2-kmp-default

suse enterprise server 12 SP5

4.12.14-122.275.1

fixed

kernel-64kb

suse enterprise desktop 15 SP6	6.4.0-150600.23.73.1 fixed
suse enterprise desktop 15 SP7	6.4.0-150700.53.19.1 fixed
suse enterprise sap 15 SP6	6.4.0-150600.23.73.1 fixed
suse enterprise sap 15 SP7	6.4.0-150700.53.19.1 fixed
suse enterprise server 15 SP6	6.4.0-150600.23.73.1 fixed
suse enterprise server 15 SP7	6.4.0-150700.53.19.1 fixed

kernel-azure

suse enterprise sap 15 SP6	6.4.0-150600.8.52.1 fixed
suse enterprise sap 15 SP7	6.4.0-150700.20.15.2 fixed
suse enterprise server 15 SP6	6.4.0-150600.8.52.1 fixed
suse enterprise server 15 SP7	6.4.0-150700.20.15.2 fixed

kernel-default

suse enterprise desktop 15 SP6	6.4.0-150600.23.73.1 fixed
suse enterprise desktop 15 SP7	6.4.0-150700.53.19.1 fixed
suse enterprise sap 15 SP6	6.4.0-150600.23.73.1 fixed
suse enterprise sap 15 SP7	6.4.0-150700.53.19.1 fixed
suse enterprise server 12 SP5	4.12.14-122.275.1 fixed
suse enterprise server 15 SP6	6.4.0-150600.23.73.1 fixed
suse enterprise server 15 SP7	6.4.0-150700.53.19.1 fixed

kernel-default-base

suse enterprise desktop 15 SP6	6.4.0-150600.23.73.1.150600.12.32.1 fixed
suse enterprise desktop 15 SP7	6.4.0-150700.53.19.1.150700.17.13.1 fixed
suse enterprise sap 15 SP6	6.4.0-150600.23.73.1.150600.12.32.1 fixed
suse enterprise sap 15 SP7	6.4.0-150700.53.19.1.150700.17.13.1 fixed
suse enterprise server 12 SP5	4.12.14-122.275.1 fixed
suse enterprise server 15 SP6	6.4.0-150600.23.73.1.150600.12.32.1 fixed
suse enterprise server 15 SP7	6.4.0-150700.53.19.1.150700.17.13.1 fixed

kernel-default-man

suse enterprise server 12 SP5

4.12.14-122.275.1

fixed

kernel-docs

suse enterprise desktop 15 SP6	6.4.0-150600.23.73.1 fixed
suse enterprise desktop 15 SP7	6.4.0-150700.53.19.1 fixed
suse enterprise sap 15 SP6	6.4.0-150600.23.73.1 fixed
suse enterprise sap 15 SP7	6.4.0-150700.53.19.1 fixed
suse enterprise server 15 SP6	6.4.0-150600.23.73.1 fixed
suse enterprise server 15 SP7	6.4.0-150700.53.19.1 fixed

kernel-macros

suse enterprise desktop 15 SP6	6.4.0-150600.23.73.1 fixed
suse enterprise desktop 15 SP7	6.4.0-150700.53.19.1 fixed
suse enterprise sap 15 SP6	6.4.0-150600.23.73.1 fixed
suse enterprise sap 15 SP7	6.4.0-150700.53.19.1 fixed
suse enterprise server 12 SP5	4.12.14-122.275.1 fixed
suse enterprise server 15 SP6	6.4.0-150600.23.73.1 fixed
suse enterprise server 15 SP7	6.4.0-150700.53.19.1 fixed

kernel-obs-build

suse enterprise desktop 15 SP6	6.4.0-150600.23.73.1 fixed
suse enterprise desktop 15 SP7	6.4.0-150700.53.19.1 fixed
suse enterprise sap 15 SP6	6.4.0-150600.23.73.1 fixed
suse enterprise sap 15 SP7	6.4.0-150700.53.19.1 fixed
suse enterprise server 15 SP6	6.4.0-150600.23.73.1 fixed
suse enterprise server 15 SP7	6.4.0-150700.53.19.1 fixed

kernel-source

suse enterprise desktop 15 SP6	6.4.0-150600.23.73.1 fixed
suse enterprise desktop 15 SP7	6.4.0-150700.53.19.1 fixed
suse enterprise sap 15 SP6	6.4.0-150600.23.73.1 fixed
suse enterprise sap 15 SP7	6.4.0-150700.53.19.1 fixed
suse enterprise server 12 SP5	4.12.14-122.275.1 fixed
suse enterprise server 15 SP6	6.4.0-150600.23.73.1 fixed
suse enterprise server 15 SP7	6.4.0-150700.53.19.1 fixed

kernel-source-azure

suse enterprise sap 15 SP6	6.4.0-150600.8.52.1 fixed
suse enterprise sap 15 SP7	6.4.0-150700.20.15.2 fixed
suse enterprise server 15 SP6	6.4.0-150600.8.52.1 fixed
suse enterprise server 15 SP7	6.4.0-150700.20.15.2 fixed

kernel-syms

suse enterprise desktop 15 SP6	6.4.0-150600.23.73.1 fixed
suse enterprise desktop 15 SP7	6.4.0-150700.53.19.1 fixed
suse enterprise sap 15 SP6	6.4.0-150600.23.73.1 fixed
suse enterprise sap 15 SP7	6.4.0-150700.53.19.1 fixed
suse enterprise server 12 SP5	4.12.14-122.275.1 fixed
suse enterprise server 15 SP6	6.4.0-150600.23.73.1 fixed
suse enterprise server 15 SP7	6.4.0-150700.53.19.1 fixed

kernel-syms-azure

suse enterprise sap 15 SP6	6.4.0-150600.8.52.1 fixed
suse enterprise sap 15 SP7	6.4.0-150700.20.15.1 fixed
suse enterprise server 15 SP6	6.4.0-150600.8.52.1 fixed
suse enterprise server 15 SP7	6.4.0-150700.20.15.1 fixed

kernel-zfcpdump

suse enterprise desktop 15 SP6	6.4.0-150600.23.73.1 fixed
suse enterprise desktop 15 SP7	6.4.0-150700.53.19.1 fixed
suse enterprise sap 15 SP6	6.4.0-150600.23.73.1 fixed
suse enterprise sap 15 SP7	6.4.0-150700.53.19.1 fixed
suse enterprise server 15 SP6	6.4.0-150600.23.73.1 fixed
suse enterprise server 15 SP7	6.4.0-150700.53.19.1 fixed

ocfs2-kmp-default

suse enterprise server 12 SP5

4.12.14-122.275.1

fixed

References

https://git.kernel.org/stable/c/0d59ce2bfc3bb13abe6240335a1bf7b96536d022

https://git.kernel.org/stable/c/1096eb63ecfc8df90b70cd068e6de0c2ff204dfd

https://git.kernel.org/stable/c/43d26997d88c4056fce0324e72f62556bc7e8e8d

https://git.kernel.org/stable/c/81278be4eb5f08ba2c68c3055893e61cc03727fe

https://git.kernel.org/stable/c/87bfabb3b2f46827639173f143aa43f7cfc0a7e6

https://git.kernel.org/stable/c/981c845f29838e468a9bfa87f784307193a31297

https://git.kernel.org/stable/c/9f9967fed9d066ed3dae9372b45ffa4f6fccfeef

https://git.kernel.org/stable/c/e1720eb32acf411c328af6a8c8f556c94535808e

https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html

https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html

https://cert-portal.siemens.com/productcert/html/ssa-032379.html

https://cert-portal.siemens.com/productcert/html/ssa-082556.html