Out-of-bounds Read in Linux
CVE-2025-39840
In the Linux kernel, the following vulnerability has been resolved: audit: fix out-of-bounds read in audit_compare_dname_path() When a watch on dir=/ is combined with an fsnotify event for a single-character name directly under / (e.g., creating /a), an out-of-bounds read can occur in audit_compare_dname_path(). The helper parent_len() returns 1 for "/". In audit_compare_dname_path(), when parentlen equals the full path length (1), the code sets p = path + 1 and pathlen = 1 - 1 = 0. The subsequent loop then dereferences p[pathlen - 1] (i.e., p[-1]), causing an out-of-bounds read. Fix this by adding a pathlen > 0 check to the while loop condition to prevent the out-of-bounds access. [PM: subject tweak, sign-off email fixes]
Vulnerability class: Buffer Overflow
Published · last modified .
CVSS v3 metric
CVSS v3 base score 7.1 (High). Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H.
EPSS exploit prediction
EPSS: 0.002 (3.6th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 4th percentile — 3.6% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.002 · newest: 0.002 · change: 0.000
Affected products
- Linux — versions e92eebb0d6116f942ab25dfb1a41905aa59472a8, 6.14, 0
- Linux Kernel — versions 6.17
Weakness classification (CWE)
References
Frequently asked questions
- What is CVE-2025-39840?
- CVE-2025-39840 is a high-severity vulnerability in Linux, classified under Out-of-bounds Read. CVSS score: 7.1/10. Published 2025-09-19.
- How severe is CVE-2025-39840?
- High severity. CVSS v3 base score is 7.1 out of 10.