CVE intelligence

CVE-2025-39783

Vulnerability intelligence

Published Sep 11, 2025Sources checked Nov 10, 2026

7.8HIGHCVSS out of 10

What this means

Review the available evidence

CVE-2025-39783 and is rated High severity with a CVSS score of 7.8. It is not in the current CISA KEV record we collected. That does not prove exploitation has not occurred.

What to do next

Remediation and response

Ubuntu Security Notices guidance

Vendor revision: Nov 10, 2026

Vendor remediation details

This update corrects flaws in the following subsystems: - HID subsystem; - InfiniBand drivers; - Network drivers; - PCI subsystem; - SCSI subsystem; - JFS file system; - Network file system (NFS) client; - OCFS2 file system; (CVE-2022-49082, CVE-2025-39730, CVE-2025-39743, CVE-2025-39783, CVE-2025-39810, CVE-2025-39824, CVE-2026-74350, CVE-2026-74394)

Ubuntu Security Notices guidance

Vendor revision: Nov 10, 2026

This update corrects flaws in the following subsystems: - HID subsystem; - InfiniBand drivers; - Network drivers; - PCI subsystem; - JFS file system; - OCFS2 file system; (CVE-2025-39743, CVE-2025-39783, CVE-2025-39810, CVE-2025-39824, CVE-2026-74350, CVE-2026-74394)

CISA KEVNot listedBased on the latest collected catalog

EPSS0.2%Estimated 30-day exploitation probability

Ransomware useNot markedCISA KEV ransomware field

Threat actors0Source-linked actor relationships

Overview

What is CVE-2025-39783?

In the Linux kernel, the following vulnerability has been resolved:

PCI: endpoint: Fix configfs group list head handling

Doing a list_del() on the epf_group field of struct pci_epf_driver in pci_epf_remove_cfs() is not correct as this field is a list head, not a list entry. This list_del() call triggers a KASAN warning when an endpoint function driver which has a configfs attribute group is torn down:

================================================================== BUG: KASAN: slab-use-after-free in pci_epf_remove_cfs+0x17c/0x198 Write of size 8 at addr ffff00010f4a0d80 by task rmmod/319

CPU: 3 UID: 0 PID: 319 Comm: rmmod Not tainted 6.16.0-rc2 #1 NONE Hardware name: Radxa ROCK 5B (DT) Call trace: show_stack+0x2c/0x84 (C) dump_stack_lvl+0x70/0x98 print_report+0x17c/0x538 kasan_report+0xb8/0x190 __asan_report_store8_noabort+0x20/0x2c pci_epf_remove_cfs+0x17c/0x198 pci_epf_unregister_driver+0x18/0x30 nvmet_pci_epf_cleanup_module+0x24/0x30 [nvmet_pci_epf] __arm64_sys_delete_module+0x264/0x424 invoke_syscall+0x70/0x260 el0_svc_common.constprop.0+0xac/0x230 do_el0_svc+0x40/0x58 el0_svc+0x48/0xdc el0t_64_sync_handler+0x10c/0x138 el0t_64_sync+0x198/0x19c ...

Remove this incorrect list_del() call from pci_epf_remove_cfs().

Source: NVD