Log in Start free

Vulnerability · Published Sep 16, 2025 · Assigned by Linux

CVE-2025-39809HID: intel-thc-hid: intel-quicki2c: Fix ACPI dsd ICRS/ISUB length

High 8.4

In plain English

A high-severity out-of-bounds write in Linux from Linux. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 5% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)8.4High
Exploit odds (30 days)0.2%top 95.0% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

In the Linux kernel, the following vulnerability has been resolved: HID: intel-thc-hid: intel-quicki2c: Fix ACPI dsd ICRS/ISUB length The QuickI2C ACPI _DSD methods return ICRS and ISUB data with a trailing byte, making the actual length is one more byte than the structs defined. It caused stack-out-of-bounds and kernel crash: kernel: BUG: KASAN: stack-out-of-bounds in quicki2c_acpi_get_dsd_property.constprop.0+0x111/0x1b0 [intel_quicki2c] kernel: Write of size 12 at addr ffff888106d1f900 by task kworker/u33:2/75 kernel: kernel: CPU: 3 UID: 0 PID: 75 Comm: kworker/u33:2 Not tainted 6.16.0+ #3 PREEMPT(voluntary) kernel: Workqueue: async async_run_entry_fn kernel: Call Trace: kernel: <TASK> kernel: dump_stack_lvl+0x76/0xa0 kernel: print_report+0xd1/0x660 kernel: ? __pfx__raw_spin_lock_irqsave+0x10/0x10 kernel: ? __kasan_slab_free+0x5d/0x80 kernel: ? kasan_addr_to_slab+0xd/0xb0 kernel: kasan_report+0xe1/0x120 kernel: ? quicki2c_acpi_get_dsd_property.constprop.0+0x111/0x1b0 [intel_quicki2c] kernel: ? quicki2c_acpi_get_dsd_property.constprop.0+0x111/0x1b0 [intel_quicki2c] kernel: kasan_check_range+0x11c/0x200 kernel: __asan_memcpy+0x3b/0x80 kernel: quicki2c_acpi_get_dsd_property.constprop.0+0x111/0x1b0 [intel_quicki2c] kernel: ? __pfx_quicki2c_acpi_get_dsd_property.constprop.0+0x10/0x10 [intel_quicki2c] kernel: quicki2c_get_acpi_resources+0x237/0x730 [intel_quicki2c] [...] kernel: </TASK> kernel: kernel: The buggy address belongs to stack of task kworker/u33:2/75 kernel: and is located at offset 48 in frame: kernel: quicki2c_get_acpi_resources+0x0/0x730 [intel_quicki2c] kernel: kernel: This frame has 3 objects: kernel: [32, 36) 'hid_desc_addr' kernel: [48, 59) 'i2c_param' kernel: [80, 224) 'i2c_config' ACPI DSD methods return: \_SB.PC00.THC0.ICRS Buffer 000000003fdc947b 001 Len 0C = 0A 00 80 1A 06 00 00 00 00 00 00 00 \_SB.PC00.THC0.ISUB Buffer 00000000f2fcbdc4 001 Len 91 = 00 00 00 00 00 00 00 00 00 00 00 00 Adding reserved padding to quicki2c_subip_acpi_parameter/config.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:14linux6.16.5-1DEBIAN-CVE-2025-39809
Ubuntu:22.04:LTSlinux-allwinner-5.19no fix listedUBUNTU-CVE-2025-39809
Ubuntu:22.04:LTSlinux-aws-5.19no fix listedUBUNTU-CVE-2025-39809
Ubuntu:24.04:LTSlinux-aws-6.146.14.0-1017.17~24.04.1UBUNTU-CVE-2025-39809
Ubuntu:22.04:LTSlinux-aws-6.2no fix listedUBUNTU-CVE-2025-39809
Ubuntu:22.04:LTSlinux-aws-6.5no fix listedUBUNTU-CVE-2025-39809
Ubuntu:22.04:LTSlinux-azure-5.19no fix listedUBUNTU-CVE-2025-39809
Ubuntu:24.04:LTSlinux-azure-6.11no fix listedUBUNTU-CVE-2025-39809
Ubuntu:24.04:LTSlinux-azure-6.146.14.0-1017.17~24.04.1UBUNTU-CVE-2025-39809
Ubuntu:22.04:LTSlinux-azure-6.2no fix listedUBUNTU-CVE-2025-39809
Ubuntu:22.04:LTSlinux-azure-6.5no fix listedUBUNTU-CVE-2025-39809
Ubuntu:25.10linux-azure-fdeno fix listedUBUNTU-CVE-2025-39809
Ubuntu:22.04:LTSlinux-azure-fde-5.19no fix listedUBUNTU-CVE-2025-39809
Ubuntu:24.04:LTSlinux-azure-fde-6.14no fix listedUBUNTU-CVE-2025-39809
Ubuntu:22.04:LTSlinux-azure-fde-6.2no fix listedUBUNTU-CVE-2025-39809
Ubuntu:24.04:LTSlinux-azure-nvidia-6.14no fix listedUBUNTU-CVE-2025-39809
Ubuntu:22.04:LTSlinux-gcp-5.19no fix listedUBUNTU-CVE-2025-39809
Ubuntu:24.04:LTSlinux-gcp-6.11no fix listedUBUNTU-CVE-2025-39809
Ubuntu:24.04:LTSlinux-gcp-6.146.14.0-1020.21~24.04.1UBUNTU-CVE-2025-39809
Ubuntu:22.04:LTSlinux-gcp-6.2no fix listedUBUNTU-CVE-2025-39809
Ubuntu:22.04:LTSlinux-gcp-6.5no fix listedUBUNTU-CVE-2025-39809
Ubuntu:22.04:LTSlinux-hwe-5.19no fix listedUBUNTU-CVE-2025-39809
Ubuntu:24.04:LTSlinux-hwe-6.11no fix listedUBUNTU-CVE-2025-39809
Ubuntu:22.04:LTSlinux-hwe-6.2no fix listedUBUNTU-CVE-2025-39809
Ubuntu:22.04:LTSlinux-hwe-6.5no fix listedUBUNTU-CVE-2025-39809
Ubuntu:24.04:LTSlinux-intelno fix listedUBUNTU-CVE-2025-39809
Ubuntu:22.04:LTSlinux-intel-iot-realtimeno fix listedUBUNTU-CVE-2025-39809
Ubuntu:22.04:LTSlinux-lowlatency-hwe-5.19no fix listedUBUNTU-CVE-2025-39809
Ubuntu:24.04:LTSlinux-lowlatency-hwe-6.11no fix listedUBUNTU-CVE-2025-39809
Ubuntu:22.04:LTSlinux-lowlatency-hwe-6.2no fix listedUBUNTU-CVE-2025-39809
Ubuntu:22.04:LTSlinux-lowlatency-hwe-6.5no fix listedUBUNTU-CVE-2025-39809
Ubuntu:22.04:LTSlinux-nvidia-6.2no fix listedUBUNTU-CVE-2025-39809
Ubuntu:22.04:LTSlinux-nvidia-6.5no fix listedUBUNTU-CVE-2025-39809
Ubuntu:22.04:LTSlinux-oem-5.17no fix listedUBUNTU-CVE-2025-39809
Ubuntu:22.04:LTSlinux-oem-6.0no fix listedUBUNTU-CVE-2025-39809
Ubuntu:22.04:LTSlinux-oem-6.1no fix listedUBUNTU-CVE-2025-39809
Ubuntu:24.04:LTSlinux-oem-6.11no fix listedUBUNTU-CVE-2025-39809
Ubuntu:24.04:LTSlinux-oem-6.146.14.0-1010.10UBUNTU-CVE-2025-39809
Ubuntu:22.04:LTSlinux-oem-6.5no fix listedUBUNTU-CVE-2025-39809
Ubuntu:24.04:LTSlinux-oem-6.8no fix listedUBUNTU-CVE-2025-39809
Ubuntu:24.04:LTSlinux-oracle-6.146.14.0-1017.17~24.04.1UBUNTU-CVE-2025-39809
Ubuntu:22.04:LTSlinux-oracle-6.5no fix listedUBUNTU-CVE-2025-39809
Ubuntu:24.04:LTSlinux-raspi-realtimeno fix listedUBUNTU-CVE-2025-39809
Ubuntu:22.04:LTSlinux-realtimeno fix listedUBUNTU-CVE-2025-39809
Ubuntu:24.04:LTSlinux-realtimeno fix listedUBUNTU-CVE-2025-39809
Ubuntu:22.04:LTSlinux-riscvno fix listedUBUNTU-CVE-2025-39809
Ubuntu:24.04:LTSlinux-riscvno fix listedUBUNTU-CVE-2025-39809
Ubuntu:22.04:LTSlinux-riscv-5.19no fix listedUBUNTU-CVE-2025-39809
Ubuntu:24.04:LTSlinux-riscv-6.146.14.0-36.36.1~24.04.1UBUNTU-CVE-2025-39809
Ubuntu:22.04:LTSlinux-riscv-6.5no fix listedUBUNTU-CVE-2025-39809
Ubuntu:22.04:LTSlinux-starfive-5.19no fix listedUBUNTU-CVE-2025-39809
Ubuntu:22.04:LTSlinux-starfive-6.2no fix listedUBUNTU-CVE-2025-39809
Ubuntu:22.04:LTSlinux-starfive-6.5no fix listedUBUNTU-CVE-2025-39809

Affected products (as reported)

VendorProductVersions
Linux Linux 5282e45ccbfa91524944a32d40386c54fdd4d145 – before 4adce86d4b13d15dec7810967839b931b15987005282e45ccbfa91524944a32d40386c54fdd4d145 – before 1db9df89a213318a48d958385dc1b17b379dc32b
Linux Linux 6.14

Weakness: CWE-787 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References