What’s Vulnerable › Vulnerabilities

CVE-2025-39794: ARM: tegra: Use I/O memcpy to write to IRAM

• Severity: medium (CVSS 5.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-09-12 · updated 2026-10-19

Description

In the Linux kernel, the following vulnerability has been resolved: ARM: tegra: Use I/O memcpy to write to IRAM Kasan crashes the kernel trying to check boundaries when using the normal memcpy.

Affected products

• Debian Linux: 11.0
• Linux kernel: from 3.4 before 5.4.297; from 5.5 before 5.10.241; from 5.11 before 5.15.190; from 5.16 before 6.1.149; from 6.2 before 6.6.103; from 6.7 before 6.12.43 — fixed in 5.10.241, 5.15.190, 5.4.297, 6.1.149, 6.12.43, 6.15.11

How to fix

Upgrade to a fixed version: Linux kernel 5.10.241, 5.15.190, 5.4.297, 6.1.149. Check the vendor advisory for mitigations.

References

• https://git.kernel.org/stable/c/2499b0ac908eefbb8a217aae609b7a5b5174f330
• https://git.kernel.org/stable/c/30ef45b89a5961cdecf907ecff1ef3374d1de510
• https://git.kernel.org/stable/c/387435f4833f97aabfd74434ee526e31e8a626ea
• https://git.kernel.org/stable/c/398e67e0f5ae04b29bcc9cbf342e339fe9d3f6f1
• https://git.kernel.org/stable/c/46b3a7a3a36d5833f14914d1b95c69d28c6a76d6
• https://git.kernel.org/stable/c/75a3bdfeed2f129a2c7d9fd7779382b78e35b014
• https://git.kernel.org/stable/c/96d6605bf0561d6e568b1dd9265a0f73b5b94f51
• https://git.kernel.org/stable/c/9b0b3b5e5cae95e09bf0ae4a9bcb58d9b6d57f87
• https://git.kernel.org/stable/c/b28c1a14accc79ead1e87bbdae53309da60be1e7
• https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html
• https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html
• https://cert-portal.siemens.com/productcert/html/ssa-032379.html

Get alerted when CVE-2025-39794 or the next vulnerability affects your stack