CVE-2025-39694 json
s390/sclp: Fix SCCB present check
published 2025-09-05 14 mo ago modified 2026-10-19 20 d ago also EUVD-2025-31531
- cvss
- 7.3
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.2%
- EPSS 0.2% chance of exploitation in 30 days, percentile 6%
- public exploits
- 0
- none known
Summary
In the Linux kernel, the following vulnerability has been resolved:
s390/sclp: Fix SCCB present check
Tracing code called by the SCLP interrupt handler contains early exits if the SCCB address associated with an interrupt is NULL. This check is performed after physical to virtual address translation.
If the kernel identity mapping does not start at address zero, the resulting virtual address is never zero, so that the NULL checks won't work. Subsequently this may result in incorrect accesses to the first page of the identity mapping.
Fix this by introducing a function that handles the NULL case before address translation.
Patch / fix
- Linux Linux 6.1.149, 6.6.103, 6.12.44, 6.16.4, 6.17
- Siemens SIMATIC CN 4100 V5.0
- linux Debian 12 6.1.153-1
- linux Debian 13 6.12.48-1
- linux Debian 14 6.16.5-1
debian advisories DEBIAN-CVE-2025-39694
- linux Ubuntu 24.04 LTS 6.8.0-100.100
- linux-aws Ubuntu 24.04 LTS 6.8.0-1046.49
- linux-gcp Ubuntu 24.04 LTS 6.8.0-1047.50
- linux-gke Ubuntu 24.04 LTS 6.8.0-1043.48
- linux-ibm Ubuntu 24.04 LTS 6.8.0-1044.44
- linux-azure Ubuntu 24.04 LTS 6.8.0-1046.52
- linux-gkeop Ubuntu 24.04 LTS 6.8.0-1030.33
- linux-raspi Ubuntu 24.04 LTS 6.8.0-1047.51
ubuntu advisories UBUNTU-CVE-2025-39694
Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0
- kernel RHEL 10.0 6.12.0-55.37.1.el10_0
- rv RHEL 10.0 6.12.0-55.37.1.el10_0
- perf RHEL 10.0 6.12.0-55.37.1.el10_0
- rtla RHEL 10.0 6.12.0-55.37.1.el10_0
- libperf RHEL 10.0 6.12.0-55.37.1.el10_0
- kernel-rt RHEL 10.0 6.12.0-55.37.1.el10_0
- kernel-64k RHEL 10.0 6.12.0-55.37.1.el10_0
- kernel-core RHEL 10.0 6.12.0-55.37.1.el10_0
red hat advisories RHSA-2025:16904RHSA-2025:16398
- kernel-rt Linux Micro 6.2 6.12.0-160000.6.1
- kernel-64kb SLES 16.0, Linux Micro 6.2, SLES for SAP applications 16.0 6.12.0-160000.6.1
- kernel-source SLES 16.0, Linux Micro 6.2, SLES for SAP applications 16.0 6.12.0-160000.6.1
- kernel-default SLES 16.0, SLE High Availability Extension 16.0, Linux Micro 6.2 +1 more 6.12.0-160000.6.1
- kernel-default-base SLES 16.0, Linux Micro 6.2, SLES for SAP applications 16.0 6.12.0-160000.6.1.160000.2.4
- kernel-syms SLES 16.0, Linux Micro Extras 6.2, SLES for SAP applications 16.0 6.12.0-160000.6.1
- kernel-obs-qa SLES for SAP applications 16.0, SLES 16.0 6.12.0-160000.6.1
- kernel-kvmsmall SLES for SAP applications 16.0, SLES 16.0 6.12.0-160000.6.1
suse advisories SUSE-SU-2025:21074-1SUSE-SU-2025:21139-1SUSE-SU-2026:20560-1SUSE-SU-2025:21179-1SUSE-SU-2025:4141-1SUSE-SU-2025:4132-1
- kernel-rt openSUSE Leap 16.0 6.12.0-160000.6.1
- dtb-aarch64 openSUSE Leap 16.0 6.12.0-160000.6.1
- kernel-64kb openSUSE Leap 16.0 6.12.0-160000.6.1
- kernel-syms openSUSE Leap 16.0 6.12.0-160000.6.1
- kernel-obs-qa openSUSE Leap 16.0 6.12.0-160000.6.1
- kernel-source openSUSE Leap 16.0 6.12.0-160000.6.1
- kernel-default openSUSE Leap 16.0 6.12.0-160000.6.1
- kernel-kvmsmall openSUSE Leap 16.0 6.12.0-160000.6.1
opensuse advisories openSUSE-SU-2025:20081-1
- kernel-abi-stablelists AlmaLinux 10 6.12.0-55.37.1.el10_0
- kernel AlmaLinux 9 5.14.0-570.46.1.el9_6
- rv AlmaLinux 9 5.14.0-570.46.1.el9_6
- perf AlmaLinux 9 5.14.0-570.46.1.el9_6
- rtla AlmaLinux 9 5.14.0-570.46.1.el9_6
- libperf AlmaLinux 9 5.14.0-570.46.1.el9_6
- kernel-rt AlmaLinux 9 5.14.0-570.46.1.el9_6
- kernel-64k AlmaLinux 9 5.14.0-570.46.1.el9_6
almalinux advisories ALSA-2025:16904ALSA-2025:16398
- kernel Rocky Linux 10 6.12.0-55.37.1.el10_0
rocky linux advisories RLSA-2025:16904
- git.kernel.org/stable/c/aa5073ac1a2a274812f3b04c278992e68ff67cc7 commit
- git.kernel.org/stable/c/86c2825791c3836a8f77a954b9c5ebe6fab410c5 commit
- git.kernel.org/stable/c/61605c847599fbfdfafe638607841c7d73719081 commit
- git.kernel.org/stable/c/bf83ae3537359af088d6577812ed93113dfbcb7b commit
- git.kernel.org/stable/c/430fa71027b6ac9bb0ce5532b8d0676777d4219a commit
Vendor advisories
What the vendors themselves say about their products: affected, fixed or not affected, and what to do.
red hat product security vex CVE-2025-39694 updated cvss 4.7
kernel: s390/sclp: Fix SCCB present check
-
Red Hat Enterprise Linux 9 kernel-rt, kernel-rt-kvm, kernel-rt-core, kernel-rt-modules, kernel-rt-debug-kvm, kernel-rt-debug-core, +12 moreaffected: workaround, no fix available “Fix deferred”
-
Red Hat Enterprise Linux AppStream (v. 9) rv 5.14.0-570.46.1.el9_6, perf 5.14.0-570.46.1.el9_6, rtla 5.14.0-570.46.1.el9_6, python3-perf 5.14.0-570.46.1.el9_6, kernel-devel-matched 5.14.0-570.46.1.el9_6, kernel-64k-devel-matched 5.14.0-570.46.1.el9_6, +7 morefixed: vendor fix RHSA-2025:16398
-
Red Hat Enterprise Linux AppStream (v. 10) rv 6.12.0-55.37.1.el10_0, perf 6.12.0-55.37.1.el10_0, rtla 6.12.0-55.37.1.el10_0, python3-perf 6.12.0-55.37.1.el10_0, kernel-devel-matched 6.12.0-55.37.1.el10_0, kernel-64k-devel-matched 6.12.0-55.37.1.el10_0, +7 morefixed: vendor fix RHSA-2025:16904
-
Red Hat Enterprise Linux BaseOS (v. 9) kernel 5.14.0-570.46.1.el9_6, kernel-64k 5.14.0-570.46.1.el9_6, kernel-core 5.14.0-570.46.1.el9_6, kernel-tools 5.14.0-570.46.1.el9_6, kernel-modules 5.14.0-570.46.1.el9_6, kernel-64k-core 5.14.0-570.46.1.el9_6, +27 morefixed: vendor fix RHSA-2025:16398
-
Red Hat Enterprise Linux BaseOS (v. 10) kernel 6.12.0-55.37.1.el10_0, kernel-64k 6.12.0-55.37.1.el10_0, kernel-core 6.12.0-55.37.1.el10_0, kernel-tools 6.12.0-55.37.1.el10_0, kernel-modules 6.12.0-55.37.1.el10_0, kernel-64k-core 6.12.0-55.37.1.el10_0, +27 morefixed: vendor fix RHSA-2025:16904
-
Red Hat Enterprise Linux CodeReady Linux Builder (v. 9) libperf 5.14.0-570.46.1.el9_6, kernel-debuginfo-common-s390x 5.14.0-570.46.1.el9_6, kernel-debuginfo-common-x86_64 5.14.0-570.46.1.el9_6, kernel-debuginfo-common-aarch64 5.14.0-570.46.1.el9_6, kernel-debuginfo-common-ppc64le 5.14.0-570.46.1.el9_6fixed: vendor fix RHSA-2025:16398
-
Red Hat Enterprise Linux CodeReady Linux Builder (v. 10) libperf 6.12.0-55.37.1.el10_0, kernel-debuginfo-common-s390x 6.12.0-55.37.1.el10_0, kernel-debuginfo-common-x86_64 6.12.0-55.37.1.el10_0, kernel-debuginfo-common-aarch64 6.12.0-55.37.1.el10_0, kernel-debuginfo-common-ppc64le 6.12.0-55.37.1.el10_0fixed: vendor fix RHSA-2025:16904
-
Red Hat Enterprise Linux Real Time (v. 9) kernel-rt 5.14.0-570.46.1.el9_6, kernel-rt-64k 5.14.0-570.46.1.el9_6, kernel-rt-core 5.14.0-570.46.1.el9_6, kernel-rt-modules 5.14.0-570.46.1.el9_6, kernel-rt-64k-core 5.14.0-570.46.1.el9_6, kernel-rt-debug-core 5.14.0-570.46.1.el9_6, +14 morefixed: vendor fix RHSA-2025:16398
show 4 moreshow fewer
-
Red Hat Enterprise Linux Real Time (v. 10) kernel-rt 6.12.0-55.37.1.el10_0, kernel-rt-64k 6.12.0-55.37.1.el10_0, kernel-rt-core 6.12.0-55.37.1.el10_0, kernel-rt-modules 6.12.0-55.37.1.el10_0, kernel-rt-64k-core 6.12.0-55.37.1.el10_0, kernel-rt-debug-core 6.12.0-55.37.1.el10_0, +14 morefixed: vendor fix RHSA-2025:16904
-
Red Hat Enterprise Linux Real Time for NFV (v. 9) kernel-rt 5.14.0-570.46.1.el9_6, kernel-rt-kvm 5.14.0-570.46.1.el9_6, kernel-rt-core 5.14.0-570.46.1.el9_6, kernel-rt-modules 5.14.0-570.46.1.el9_6, kernel-rt-debug-kvm 5.14.0-570.46.1.el9_6, kernel-rt-debug-core 5.14.0-570.46.1.el9_6, +6 morefixed: vendor fix RHSA-2025:16398
-
Red Hat Enterprise Linux Real Time for NFV (v. 10) kernel-rt 6.12.0-55.37.1.el10_0, kernel-rt-kvm 6.12.0-55.37.1.el10_0, kernel-rt-core 6.12.0-55.37.1.el10_0, kernel-rt-modules 6.12.0-55.37.1.el10_0, kernel-rt-debug-kvm 6.12.0-55.37.1.el10_0, kernel-rt-debug-core 6.12.0-55.37.1.el10_0, +6 morefixed: vendor fix RHSA-2025:16904
-
Red Hat Enterprise Linux 6 perf, kernel, python-perf, kernel-kdump, kernel-firmware, kernel-bootwrapper, +1 more Red Hat Enterprise Linux 7 perf, kernel, bpftool, kernel-rt, python-perf, kernel-kdump, +8 more Red Hat Enterprise Linux 8 perf, kernel, bpftool, kernel-rt, kernel-core, kernel-tools, +29 morenot affected: vulnerable code not present
Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf
cisa ICSA-26-134-10 updated cvss 7.0
Siemens SIMATIC
-
Siemens SIMATIC CN 4100 < 5.0affected: fixed in V5.0 support.industry.siemens.com
Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf
Exploit prediction
0.17% chance of exploitation in the next 30 days, higher than 6% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 7.3 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H |
| NVD | 3.1 | 5.5 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H |
Affected products
- Linux Linux
- Siemens SIMATIC CN 4100
Classification
- Weakness
-
- CWE-476 NULL Pointer Dereference
- Technology feeds
References
-
git.kernel.org
/stable/c/aa5073ac1a2a274812f3b04c278992e68ff67cc7
patch
-
git.kernel.org
/stable/c/86c2825791c3836a8f77a954b9c5ebe6fab410c5
patch
-
git.kernel.org
/stable/c/61605c847599fbfdfafe638607841c7d73719081
patch
-
git.kernel.org
/stable/c/bf83ae3537359af088d6577812ed93113dfbcb7b
patch
-
git.kernel.org
/stable/c/430fa71027b6ac9bb0ce5532b8d0676777d4219a
patch
-
lists.debian.org
/debian-lts-announce/2025/10/msg00008.html
third-party-advisory
- cert-portal.siemens.com /productcert/html/ssa-032379.html
Sources
- CVE List CVE-2025-39694
- NVD CVE-2025-39694
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.