What is the CVSS score of CVE-2025-39962?

CVE-2025-39962 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Linux Kernel are affected by CVE-2025-39962?

A memory corruption vulnerability in Linux 6.17 pre-release kernel versions could allow system-level compromise for organizations running these kernels, though limited rc kernel adoption…. A patch is available.

How to fix or mitigate CVE-2025-39962?

Within 24 hours, audit your infrastructure for any systems running Linux 6.17-rc kernels (rc1 through rc6) and evaluate their production status. Within 7 days, obtain the patched kernel version from your Linux distribution provider and begin testing in your standard QA environment. Complete deployment to all affected systems within 30 days, prioritizing any production-facing servers or systems with external network access.

Linux Kernel CVE-2025-39962

HIGH

Out-of-bounds Write (CWE-787)

2025-10-09 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Buffer Overflow Linux Memory Corruption Red Hat Suse

7.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.1 HIGH

Untrusted data arrives in a network response packet (AV:N), but requires the non-default RxGK/AFS path and a malicious peer server (AC:H); no local privileges needed (PR:N), with kernel memory-corruption impact.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE

5.5 MEDIUM

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 30, 2026 - 08:14 vuln.today

CVE Published

Oct 09, 2025 - 13:15 nvd

HIGH 7.8

DescriptionNVD

In the Linux kernel, the following vulnerability has been resolved:

rxrpc: Fix untrusted unsigned subtract

Fix the following Smatch static checker warning:

net/rxrpc/rxgk_app.c:65 rxgk_yfs_decode_ticket() warn: untrusted unsigned subtract. 'ticket_len - 10 * 4'

by prechecking the length of what we're trying to extract in two places in the token and decoding for a response packet.

Also use sizeof() on the struct we're extracting rather specifying the size numerically to be consistent with the other related statements.

AnalysisAI

Kernel-level memory corruption in the Linux kernel's rxrpc/RxGK subsystem allows an out-of-bounds access when the rxgk_yfs_decode_ticket() function parses an authentication response packet. The flaw stems from an unchecked unsigned subtraction ('ticket_len - 10 * 4') on attacker-influenced length data, which can underflow and drive an out-of-bounds write (CWE-787). It affects Linux 6.17 release-candidate kernels (rc1 through rc6); there is no public exploit identified at time of analysis, and EPSS exploitation probability is very low at 0.13% (3rd percentile).

Technical ContextAI

The affected code lives in net/rxrpc/rxgk_app.c, part of the kernel's AF_RXRPC implementation used by the in-kernel AFS filesystem client (kAFS) and the RxGK (Rx GSS/Kerberos) security class. During the RxGK authentication handshake, the kernel decodes a YFS ticket embedded in a response packet. The Smatch static analyzer flagged an 'untrusted unsigned subtract' where a length field taken from the packet is decremented by a fixed header size before being used; because the value is unsigned, a too-small ticket_len wraps to a huge number instead of going negative, defeating subsequent bounds logic. The CWE-787 (Out-of-bounds Write) classification and the vendor's 'Buffer Overflow / Memory Corruption' tags indicate the miscomputed length can drive access past the intended buffer. The fix prechecks the extractable length in two places and switches from hardcoded byte sizes to sizeof() on the extracted struct for consistency.

RemediationAI

Upstream fix available (commits, not a tagged stable release); a released patched version is not independently confirmed from the input. Apply the mainline fix by updating to a 6.17 build that includes commits 2429a197648178cd4dc930a9d87c13c547460564 and 71571e187106631a8127f2dde780f35caa358d33 (https://git.kernel.org/stable/c/2429a197648178cd4dc930a9d87c13c547460564 and https://git.kernel.org/stable/c/71571e187106631a8127f2dde780f35caa358d33), or move off the 6.17-rc series to a fixed release once tagged. As a compensating control until patched, avoid running 6.17 release-candidate kernels in production; if kAFS/RxGK is not needed, build or load the kernel without the AF_RXRPC/rxgk functionality (do not load the rxrpc/kafs modules), which removes the vulnerable code path at the cost of losing AFS client support. Where AFS is required, restrict clients to trusted, authenticated AFS servers and constrain network paths to reduce the chance of processing a malicious response packet, accepting that this does not fully eliminate a compromised-server or MITM risk.

Same weakness CWE-787 – Out-of-bounds Write

View all

CVE-2015-3113 CRITICAL POC

9.8

CVE-2011-2462 CRITICAL POC

9.8

CVE-2012-1889 HIGH POC

8.8

CVE-2010-3333 HIGH POC

7.8

CVE-2014-1761 HIGH POC

7.8

CVE-2009-3129 HIGH POC

7.8

CVE-2021-1732 HIGH POC

7.8

CVE-2013-3346 CRITICAL POC

9.8

Same technique Buffer Overflow

View all

CVE-2017-7269 CRITICAL POC

9.8

CVE-2015-5119 CRITICAL POC

9.8

CVE-2015-3113 CRITICAL POC

9.8

CVE-2011-2462 CRITICAL POC

9.8

CVE-2020-0796 CRITICAL POC

10.0

CVE-2019-11043 CRITICAL POC

9.8

CVE-2009-0927 HIGH POC

8.8

CVE-2012-1889 HIGH POC

8.8

Vendor StatusVendor

SUSE

Severity: Moderate

Product	Status
SUSE Linux Enterprise Desktop 15 SP7	Not-Affected
SUSE Linux Enterprise Desktop 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Not-Affected
SUSE Linux Enterprise High Performance Computing 15 SP7	Not-Affected

CVE-2025-39962 vulnerability details – vuln.today

Back

Linux Kernel CVE-2025-39962

Severity by source

CVSS VectorNVD

Lifecycle Timeline

DescriptionNVD

AnalysisAI

Technical ContextAI

RemediationAI

Same weakness CWE-787 – Out-of-bounds Write

Same technique Buffer Overflow

Vendor StatusVendor

SUSE

Share

External POC / Exploit Code