Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1000 CNY

100.0%
Buy Us a Coffee

CVE-2025-39865— tee: fix NULL pointer dereference in tee_shm_put

EPSS 0.02% · P5

Affected Version Matrix 19

VendorProductVersion RangeStatus
LinuxLinuxc05d8f66ec3470e5212c4d08c46d6cb5738d600d< f266188603c34e6e234fb0dfc3185f0ba98d71b7affected
492eb7afe858d60408b2da09adc78540c4d16543< 4377eac565c297fdfccd2f8e9bf94ee84ff6172faffected
dfd0743f1d9ea76931510ed150334d571fbab49d< 25e315bc8ad363bd1194e49062f183ad4011957eaffected
dfd0743f1d9ea76931510ed150334d571fbab49d< add1ecc8f3ad8df22e3599c5c88d7907cc2a3079affected
dfd0743f1d9ea76931510ed150334d571fbab49d< 963fca19fe34c496e04f7dd133b807b76a5434caaffected
dfd0743f1d9ea76931510ed150334d571fbab49d< 5e07a4235bb85d9ef664411e4ff4ac34783c18ffaffected
dfd0743f1d9ea76931510ed150334d571fbab49d< e4a718a3a47e89805c3be9d46a84de1949a98d5daffected
3d556a28bbfe34a80b014db49908b0f1bcb1ae80affected
… +11 more rows
Get alerts for future matching vulnerabilitiesLog in to subscribe

I. Basic Information for CVE-2025-39865

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
tee: fix NULL pointer dereference in tee_shm_put
Source: NVD (National Vulnerability Database)
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: tee: fix NULL pointer dereference in tee_shm_put tee_shm_put have NULL pointer dereference: __optee_disable_shm_cache --> shm = reg_pair_to_ptr(...);//shm maybe return NULL tee_shm_free(shm); --> tee_shm_put(shm);//crash Add check in tee_shm_put to fix it. panic log: Unable to handle kernel paging request at virtual address 0000000000100cca Mem abort info: ESR = 0x0000000096000004 EC = 0x25: DABT (current EL), IL = 32 bits SET = 0, FnV = 0 EA = 0, S1PTW = 0 FSC = 0x04: level 0 translation fault Data abort info: ISV = 0, ISS = 0x00000004, ISS2 = 0x00000000 CM = 0, WnR = 0, TnD = 0, TagAccess = 0 GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0 user pgtable: 4k pages, 48-bit VAs, pgdp=0000002049d07000 [0000000000100cca] pgd=0000000000000000, p4d=0000000000000000 Internal error: Oops: 0000000096000004 [#1] SMP CPU: 2 PID: 14442 Comm: systemd-sleep Tainted: P OE ------- ---- 6.6.0-39-generic #38 Source Version: 938b255f6cb8817c95b0dd5c8c2944acfce94b07 Hardware name: greatwall GW-001Y1A-FTH, BIOS Great Wall BIOS V3.0 10/26/2022 pstate: 80000005 (Nzcv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : tee_shm_put+0x24/0x188 lr : tee_shm_free+0x14/0x28 sp : ffff001f98f9faf0 x29: ffff001f98f9faf0 x28: ffff0020df543cc0 x27: 0000000000000000 x26: ffff001f811344a0 x25: ffff8000818dac00 x24: ffff800082d8d048 x23: ffff001f850fcd18 x22: 0000000000000001 x21: ffff001f98f9fb88 x20: ffff001f83e76218 x19: ffff001f83e761e0 x18: 000000000000ffff x17: 303a30303a303030 x16: 0000000000000000 x15: 0000000000000003 x14: 0000000000000001 x13: 0000000000000000 x12: 0101010101010101 x11: 0000000000000001 x10: 0000000000000001 x9 : ffff800080e08d0c x8 : ffff001f98f9fb88 x7 : 0000000000000000 x6 : 0000000000000000 x5 : 0000000000000000 x4 : 0000000000000000 x3 : 0000000000000000 x2 : ffff001f83e761e0 x1 : 00000000ffff001f x0 : 0000000000100cca Call trace: tee_shm_put+0x24/0x188 tee_shm_free+0x14/0x28 __optee_disable_shm_cache+0xa8/0x108 optee_shutdown+0x28/0x38 platform_shutdown+0x28/0x40 device_shutdown+0x144/0x2b0 kernel_power_off+0x3c/0x80 hibernate+0x35c/0x388 state_store+0x64/0x80 kobj_attr_store+0x14/0x28 sysfs_kf_write+0x48/0x60 kernfs_fop_write_iter+0x128/0x1c0 vfs_write+0x270/0x370 ksys_write+0x6c/0x100 __arm64_sys_write+0x20/0x30 invoke_syscall+0x4c/0x120 el0_svc_common.constprop.0+0x44/0xf0 do_el0_svc+0x24/0x38 el0_svc+0x24/0x88 el0t_64_sync_handler+0x134/0x150 el0t_64_sync+0x14c/0x15
Source: NVD (National Vulnerability Database)
CVSS Information
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Type
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Title
Linux kernel 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于tee_shm_put函数缺少空指针检查，可能导致空指针取消引用。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

VendorProductAffected VersionsCPESubscribe
LinuxLinux c05d8f66ec3470e5212c4d08c46d6cb5738d600d ~ f266188603c34e6e234fb0dfc3185f0ba98d71b7 -
LinuxLinux 5.16 -

II. Public POCs for CVE-2025-39865

#POC DescriptionSource LinkShenlong Link
AI-Generated POCPremium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2025-39865

请登录查看更多情报信息。

Same Patch Batch · Linux · 2025-09-19 · 30 CVEs total

CVE-2025-39852net/tcp: Fix socket memory leak in TCP-AO failure handling for IPv6
CVE-2025-39837platform/x86: asus-wmi: Fix racy registrations
CVE-2025-39838cifs: prevent NULL pointer dereference in UTF16 conversion
CVE-2025-39839batman-adv: fix OOB read/write in network-coding decode
CVE-2025-39840audit: fix out-of-bounds read in audit_compare_dname_path()
CVE-2025-39841scsi: lpfc: Fix buffer free/clear order in deferred receive path
CVE-2025-39842ocfs2: prevent release journal inode after journal shutdown
CVE-2025-39844mm: move page table sync declarations to linux/pgtable.h
CVE-2025-39843mm: slub: avoid wake up kswapd in set_track_prepare
CVE-2025-39845x86/mm/64: define ARCH_PAGE_TABLE_SYNC_MASK and arch_sync_kernel_mappings()
CVE-2025-39846pcmcia: Fix a NULL pointer dereference in __iodyn_find_io_region()
CVE-2025-39847ppp: fix memory leak in pad_compress_skb
CVE-2025-39848ax25: properly unshare skbs in ax25_kiss_rcv()
CVE-2025-39849wifi: cfg80211: sme: cap SSID length in __cfg80211_connect_result()
CVE-2025-39850vxlan: Fix NPD in {arp,neigh}_reduce() when using nexthop objects
CVE-2025-39866fs: writeback: fix use-after-free in __mark_inode_dirty()
CVE-2025-39851vxlan: Fix NPD when refreshing an FDB entry with a nexthop object
CVE-2025-39853i40e: Fix potential invalid access when MAC list is empty
CVE-2025-39854ice: fix NULL access of tx->in_use in ice_ll_ts_intr
CVE-2025-39856net: ethernet: ti: am65-cpsw-nuss: Fix null pointer dereference for ndev

Showing top 20 of 30 CVEs. View all on vendor page &rarr; →

IV. Related Vulnerabilities

Same product: Linux
Same vendor: Linux

V. Comments for CVE-2025-39865

No comments yet

Leave a comment