CVE-2025-39694

s390/sclp: Fix SCCB present check

MEDIUM
5.5
CVSS Score
Published: September 5, 2025 at 05:21 PM UTC
Updated: October 19, 2026 at 09:10 PM UTC
3 products affected across 3 vendorsLinux KernelDebian LinuxSIMATIC CN 4100

Using Linux by Linux?

Get instant alerts when new vulnerabilities affect Linux - before attackers find them.

Real-time alertsTrack your software stackFree plan available
Severity
MEDIUM5.5
Exploit prediction
EPSS 0.2%

Description

In the Linux kernel, the following vulnerability has been resolved: s390/sclp: Fix SCCB present check Tracing code called by the SCLP interrupt handler contains early exits if the SCCB address associated with an interrupt is NULL. This check is performed after physical to virtual address translation. If the kernel identity mapping does not start at address zero, the resulting virtual address is never zero, so that the NULL checks won't work. Subsequently this may result in incorrect accesses to the first page of the identity mapping. Fix this by introducing a function that handles the NULL case before address translation.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

5.16 ≤ v < 6.1.1496.13 ≤ v < 6.16.46.2 ≤ v < 6.6.1036.7 ≤ v < 6.12.446.176.17 rc16.17 rc2ada1da31ce34248bc97ca8f801f2cf6efa378a81
Vendor states this is fixed in 430fa71027b6ac9bb0ce5532b8d0676777d4219a (fixed)
Vendor states this is fixed in 61605c847599fbfdfafe638607841c7d73719081 (fixed)
Vendor states this is fixed in 86c2825791c3836a8f77a954b9c5ebe6fab410c5 (fixed)
Vendor states this is fixed in aa5073ac1a2a274812f3b04c278992e68ff67cc7 (fixed)
Vendor states this is fixed in bf83ae3537359af088d6577812ed93113dfbcb7b (fixed)
Vendor states this is fixed in 5.16 (unaffected)
Vendor states this is fixed in 6.1.149 (unaffected)
Vendor states this is fixed in 6.12.44 (unaffected)
Vendor states this is fixed in 6.16.4 (unaffected)
Vendor states this is fixed in 6.17 (unaffected)
Vendor states this is fixed in 6.6.103 (unaffected)
v < V5.0
Affected range stops below V5.0, so it looks safe — our inference, not a vendor statement

References (7)

Patch
Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/430fa71027b6ac9bb0ce5532b8d0676777d4219a
Patch
Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/61605c847599fbfdfafe638607841c7d73719081
Patch
Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/86c2825791c3836a8f77a954b9c5ebe6fab410c5
Patch
Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/aa5073ac1a2a274812f3b04c278992e68ff67cc7
Patch
Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/bf83ae3537359af088d6577812ed93113dfbcb7b
Third Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html
Source: 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e
https://cert-portal.siemens.com/productcert/html/ssa-032379.html

CVSS

Attack Vector
LOCAL
Complexity
LOW
Privileges
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
NONE
Integrity
NONE
Availability
HIGH
Vector?

Quick Info

StatusMODIFIED
CWE
CWE-476

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Free plan, no card