Riskcovery

CVE-2025-39951

um: virtio_uml: Fix use-after-free after put_device in probe

State
Published
Severity
7.8 High
Published
Oct 4, 2025
Updated
Aug 5, 2026
Reserved
Apr 16, 2025

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

um: virtio_uml: Fix use-after-free after put_device in probe

When register_virtio_device() fails in virtio_uml_probe(), the code sets vu_dev->registered = 1 even though the device was not successfully registered. This can lead to use-after-free or other issues.

Scores

CVSSScoreVectorSource
3.17.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HLinux

Weaknesses

The record names no weakness.

Affected Products

ProductVersions
LinuxLinux
  • 04e5b1fb01834a602acaae2276b67a783a8c6159 to before 14c231959a16ca41bfdcaede72483362a8c645d7Affected
  • 04e5b1fb01834a602acaae2276b67a783a8c6159 to before 5e94e44c9cb30d7a383d8ac227f24a8c9326b770Affected
  • 04e5b1fb01834a602acaae2276b67a783a8c6159 to before aaf900a83508c8cd5cdf765e7749f9076196ec7fAffected
  • 04e5b1fb01834a602acaae2276b67a783a8c6159 to before 4f364023ddcfe83f7073b973a9cb98584b7f2a46Affected
  • 04e5b1fb01834a602acaae2276b67a783a8c6159 to before 00e98b5a69034b251bb36dc6e7123d7648e218e4Affected
  • 04e5b1fb01834a602acaae2276b67a783a8c6159 to before c2ff91255e0157b356cff115d8dc3eeb5162edf2Affected
  • 04e5b1fb01834a602acaae2276b67a783a8c6159 to before 7ebf70cf181651fe3f2e44e95e7e5073d594c9c0Affected
LinuxLinux
  • 5.5Affected
  • before 5.5Not affected
  • 5.10.245 through 5.10.*Not affected
  • 5.15.194 through 5.15.*Not affected
  • 6.1.154 through 6.1.*Not affected
  • 6.6.108 through 6.6.*Not affected
  • 6.12.49 through 6.12.*Not affected
  • 6.16.9 through 6.16.*Not affected
  • 6.17 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.