{"id":"CVE-2025-39939","title":"iommu/s390: Fix memory corruption when using identity domain","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\niommu/s390: Fix memory corruption when using identity domain\n\nzpci_get_iommu_ctrs() returns counter information to be reported as part\nof device statistics; these count…","severity":"high","cvss":7.8,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvssSource":"cna","vendor":"Linux","product":"Linux","affected":["Linux >= 64af12c6ec3afd7d44bc8b2044eee59f98059087 < 17a58caf3863163c4a84a218a9649be2c8061443","Linux >= 64af12c6ec3afd7d44bc8b2044eee59f98059087 < b3506e9bcc777ed6af2ab631c86a9990ed97b474","Linux 6.15"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total","timestamp":"2026-10-15T21:54:54.159629Z"},"published":"2025-10-04","updated":"2026-10-15","sourceUpdated":"2026-10-15T22:02:33.574Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2025-39939","references":[{"url":"https://git.kernel.org/stable/c/17a58caf3863163c4a84a218a9649be2c8061443"},{"url":"https://git.kernel.org/stable/c/b3506e9bcc777ed6af2ab631c86a9990ed97b474"}],"tags":["cve.org"],"epss":0.00147,"epssPercentile":0.03897,"ingestedAt":"2026-10-15T22:48:25.531Z","slug":"CVE-2025-39939","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\niommu/s390: Fix memory corruption when using identity domain\n\nzpci_get_iommu_ctrs() returns counter information to be reported as part\nof device statistics; these counters are stored as part of the s390_domain.\nThe problem, however, is that the identity domain is not backed by an\ns390_domain and so the conversion via to_s390_domain() yields a bad address\nthat is zero'd initially and read on-demand later via a sysfs read.\nThese counters aren't necessary for the identity domain; just return NULL\nin this case.\n\nThis issue was discovered via KASAN with reports that look like:\nBUG: KASAN: global-out-of-bounds in zpci_fmb_enable_device\nwhen using the identity domain for a device on s390.\n\n## Affected\n\n- `Linux >= 64af12c6ec3afd7d44bc8b2044eee59f98059087 < 17a58caf3863163c4a84a218a9649be2c8061443`\n- `Linux >= 64af12c6ec3afd7d44bc8b2044eee59f98059087 < b3506e9bcc777ed6af2ab631c86a9990ed97b474`\n- `Linux 6.15`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":43,"depthScoreParts":{"impact":42.9,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}