CVE-2025-39787

soc: qcom: mdt_loader: Ensure we don't read past the ELF header

State: Published
Severity: 7.8 High
Published: Sep 11, 2025
Updated: Oct 15, 2026
Reserved: Apr 16, 2025

Description

In the Linux kernel, the following vulnerability has been resolved:

soc: qcom: mdt_loader: Ensure we don't read past the ELF header

When the MDT loader is used in remoteproc, the ELF header is sanitized beforehand, but that's not necessary the case for other clients.

Validate the size of the firmware buffer to ensure that we don't read past the end as we iterate over the header. e_phentsize and e_shentsize are validated as well, to ensure that the assumptions about step size in the traversal are valid.

Scores

CVSS	Score	Vector	Source
3.1	7.8 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	2aad40d911eeb7dcac91c669f2762a28134f0eb1 to before 1096eb63ecfc8df90b70cd068e6de0c2ff204dfdAffected 2aad40d911eeb7dcac91c669f2762a28134f0eb1 to before e1720eb32acf411c328af6a8c8f556c94535808eAffected 2aad40d911eeb7dcac91c669f2762a28134f0eb1 to before 0d59ce2bfc3bb13abe6240335a1bf7b96536d022Affected 2aad40d911eeb7dcac91c669f2762a28134f0eb1 to before 43d26997d88c4056fce0324e72f62556bc7e8e8dAffected 2aad40d911eeb7dcac91c669f2762a28134f0eb1 to before 981c845f29838e468a9bfa87f784307193a31297Affected 2aad40d911eeb7dcac91c669f2762a28134f0eb1 to before 87bfabb3b2f46827639173f143aa43f7cfc0a7e6Affected 2aad40d911eeb7dcac91c669f2762a28134f0eb1 to before 81278be4eb5f08ba2c68c3055893e61cc03727feAffected 2aad40d911eeb7dcac91c669f2762a28134f0eb1 to before 9f9967fed9d066ed3dae9372b45ffa4f6fccfeefAffected
LinuxLinux	4.11Affected before 4.11Not affected 5.4.297 through 5.4.Not affected 5.10.241 through 5.10.Not affected 5.15.190 through 5.15.Not affected 6.1.149 through 6.1.Not affected 6.6.103 through 6.6.Not affected 6.12.44 through 6.12.Not affected 6.16.4 through 6.16.*Not affected 6.17 and laterNot affected

Product

Versions

LinuxLinux

2aad40d911eeb7dcac91c669f2762a28134f0eb1 to before 1096eb63ecfc8df90b70cd068e6de0c2ff204dfdAffected
2aad40d911eeb7dcac91c669f2762a28134f0eb1 to before e1720eb32acf411c328af6a8c8f556c94535808eAffected
2aad40d911eeb7dcac91c669f2762a28134f0eb1 to before 0d59ce2bfc3bb13abe6240335a1bf7b96536d022Affected
2aad40d911eeb7dcac91c669f2762a28134f0eb1 to before 43d26997d88c4056fce0324e72f62556bc7e8e8dAffected
2aad40d911eeb7dcac91c669f2762a28134f0eb1 to before 981c845f29838e468a9bfa87f784307193a31297Affected
2aad40d911eeb7dcac91c669f2762a28134f0eb1 to before 87bfabb3b2f46827639173f143aa43f7cfc0a7e6Affected
2aad40d911eeb7dcac91c669f2762a28134f0eb1 to before 81278be4eb5f08ba2c68c3055893e61cc03727feAffected
2aad40d911eeb7dcac91c669f2762a28134f0eb1 to before 9f9967fed9d066ed3dae9372b45ffa4f6fccfeefAffected

LinuxLinux

4.11Affected
before 4.11Not affected
5.4.297 through 5.4.*Not affected
5.10.241 through 5.10.*Not affected
5.15.190 through 5.15.*Not affected
6.1.149 through 6.1.*Not affected
6.6.103 through 6.6.*Not affected
6.12.44 through 6.12.*Not affected
6.16.4 through 6.16.*Not affected
6.17 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.