Linux Kernel up to 6.16.4/6.17-rc3 kbuf buffer overflow

Summaryinfo

A vulnerability has been found in Linux Kernel up to 6.16.4/6.17-rc3 and classified as critical. Impacted is an unknown function of the component kbuf. This manipulation causes buffer overflow. The identification of this vulnerability is CVE-2025-39816. The attack can only be executed locally. There is no exploit available. The affected component should be upgraded.

Detailsinfo

A vulnerability was found in Linux Kernel up to 6.16.4/6.17-rc3. It has been declared as critical. Affected by this vulnerability is an unknown part of the component kbuf. The manipulation with an unknown input leads to a buffer overflow vulnerability. The CWE definition for the vulnerability is CWE-120. The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer, leading to a buffer overflow. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

In the Linux kernel, the following vulnerability has been resolved: io_uring/kbuf: always use READ_ONCE() to read ring provided buffer lengths Since the buffers are mapped from userspace, it is prudent to use READ_ONCE() to read the value into a local variable, and use that for any other actions taken. Having a stable read of the buffer length avoids worrying about it changing after checking, or being read multiple times. Similarly, the buffer may well change in between it being picked and being committed. Ensure the looping for incremental ring buffer commit stops if it hits a zero sized buffer, as no further progress can be made at that point.

It is possible to read the advisory at git.kernel.org. This vulnerability is known as CVE-2025-39816 since 04/16/2025. The exploitation appears to be easy. Attacking locally is a requirement. The technical details are unknown and an exploit is not publicly available. The pricing for an exploit might be around USD $0-$5k at the moment (estimation calculated on 12/27/2025).

The vulnerability scanner Nessus provides a plugin with the ID 265205 (Linux Distros Unpatched Vulnerability : CVE-2025-39816), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 6.16.5 or 6.17-rc4 eliminates this vulnerability. Applying the patch 390a61d284e1ced088d43928dfcf6f86fffdd780/98b6fa62c84f2e129161e976a5b9b3cb4ccd117b is able to eliminate this problem. The bugfix is ready for download at git.kernel.org. The best possible mitigation is suggested to be upgrading to the latest version.

The vulnerability is also documented in the databases at Tenable (265205), EUVD (EUVD-2025-29598) and CERT Bund (WID-SEC-2025-2077). Be aware that VulDB is the high quality source for vulnerability data.

Affected

• Debian Linux
• Amazon Linux 2
• Red Hat Enterprise Linux
• Ubuntu Linux
• SUSE Linux
• Oracle Linux
• IBM QRadar SIEM
• SUSE openSUSE
• Open Source Linux Kernel
• RESF Rocky Linux
• Dell Secure Connect Gateway

Productinfo

Type

• Operating System

Vendor

• Linux

Name

• Kernel

Version

• 6.16.0
• 6.16.1
• 6.16.2
• 6.16.3
• 6.16.4
• 6.17-rc1
• 6.17-rc2
• 6.17-rc3

License

• open-source

Website

• Vendor: https://www.kernel.org/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion