Junglewise Threat Intelligence

CVE-2025-39795: Linux Kernel integer overflow in blk_stack_limits

CVE-2025-39795 · Severity: medium · CVSS 5.5 · Published 2025-09-12

Technologies: Siemens SIMATIC CN 4100, Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP, Linux Kernel. Vendors: Siemens, Linux.

Executive brief

A vulnerability in the Linux kernel's block layer could allow a local user to cause a system crash or instability. The issue occurs when the system calculates storage device parameters, where a mathematical overflow can lead to incorrect memory handling. This affects various Linux-based systems, including industrial controllers from Siemens, potentially impacting operational availability.

Technical details

An integer overflow vulnerability exists in the Linux kernel block layer within the blk_stack_limits() function in block/blk-settings.c. The vulnerability is caused by shifting the 'chunk_sectors' value by 9 bits to convert it to bytes for a alignment check against 'physical_block_size'. On systems with large chunk sizes, this left-shift can overflow an unsigned integer, causing the alignment check to fail or behave unpredictably. An attacker with local access could potentially exploit this to cause a denial-of-service (system crash). The fix changes the logic to perform the modulo check using sector units instead of byte units to avoid the overflow. Patches have been backported to multiple stable kernel branches.

Affected products

  • Linux Linux Kernel All versions prior to the August 2025 patches
  • Siemens SIMATIC CN 4100 prior to V5.0
  • Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP V3.1.5 and V3.1.6

Timeline

  • 2025-07-29: disclosed: Initial patch submission by John Garry
  • 2025-08-20: patched: Patch committed to stable kernel tree
  • 2025-09-12: advisory: CVE published

References

Related threats