Cyber Resilience

CVE-2025-39853

Memory Safety in Linux Kernel 4.6 – 5.4.299

Published
19 September 2025
Modified
12 May 2026
Patch / advisory
CVSS Score v3.1 7.1
Click a component to see what it means
Raw vectorCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
EPSS Score 0.0015 5th percentile
Risk Priority 55 floored blend · peak EPSS

Summary

CVE-2025-39853 is a high-severity Out-of-bounds Read (CWE-125) vulnerability in Linux Linux Kernel. Its CVSS base score is 7.1 (High).

Operationally, ranked at the 5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified map to SI-2 (Flaw Remediation) and SI-16 (Memory Protection) — see the control section below for these in your framework.

EU & UK References

Vulnerability Data

In the Linux kernel, the following vulnerability has been resolved: i40e: Fix potential invalid access when MAC list is empty list_first_entry() never returns NULL - if the list is empty, it still returns a pointer to an invalid object, leading…

more

to potential invalid memory access when dereferenced. Fix this by using list_first_entry_or_null instead of list_first_entry.

CWE(s)

Related Threats

CVEs Like This One

CVE-2025-38320Same product: Debian Debian Linux
CVE-2025-38483Same product: Debian Debian Linux
CVE-2025-38714Same product: Debian Debian Linux
CVE-2025-39710Same product: Debian Debian Linux
CVE-2024-35967Same product: Debian Debian Linux
CVE-2025-38530Same product: Debian Debian Linux
CVE-2025-38482Same product: Debian Debian Linux
CVE-2025-38027Same product: Debian Debian Linux
CVE-2023-6040Same product: Debian Debian Linux
CVE-2025-37780Same product: Debian Debian Linux

Affected Assets

linux
linux kernel
6.17 · 4.6 — 5.4.299 · 5.5 — 5.10.243 · 5.11 — 5.15.192
debian
debian linux
11.0

Mitigating Controls

Control response

Prevent
Stop it (NIST 800-53)
Detect
Catch it (NIST detect / respond)
  • SI-4 System Monitoring
Harden
Shrink the surface (DISA STIG)

Validate
Prove the fix (OWASP ASVS)

Mitigating Controls (NIST 800-53 r5) AI

prevent

Directly requires timely application of the vendor patch that replaces list_first_entry with list_first_entry_or_null to eliminate the invalid memory access.

prevent

Enforces memory protection mechanisms that can contain or block the invalid dereference resulting from an empty list pointer.

detect

Enables monitoring for kernel oops, page faults, or anomalous memory accesses that would be triggered by the flawed list handling.

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.PS-06 mostly match
prevents

Secure-development practices such as bounds checking and memory-safe languages directly prevent out-of-bounds reads.

ID.RA-01 partial match
prevents

Vulnerability scanning and recording can discover instances of out-of-bounds reads after code is deployed.

PR.PS-02 partial match
prevents

Routine patching replaces vulnerable code containing out-of-bounds read flaws.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

detects

Security testing in development and acceptance includes fuzzing and static analysis that detect out-of-bounds read defects before release.

A.8.15 Logging partial match
detects

Logging can record evidence of an out-of-bounds read but does not prevent the weakness itself.

prevents

Secure development life cycle mandates input validation and bounds checking that directly prevent out-of-bounds reads.

prevents

Application security requirements include explicit bounds and memory-safety specifications that mitigate buffer over-reads.

prevents

Secure system architecture and engineering principles require memory-safe design patterns and runtime protections against out-of-bounds access.

prevents

Secure coding standards explicitly forbid unsafe pointer arithmetic and mandate bounds-checked reads, eliminating CWE-125.

References