CVE-2025-39763

ACPI: APEI: send SIGBUS to current task if synchronous memory error not recovered

MEDIUM
5.5
CVSS Score
Published: September 11, 2025 at 04:52 PM UTC
Updated: October 19, 2026 at 09:10 PM UTC
1 product affected across 1 vendorLinux Kernel

Using Linux by Linux?

Get instant alerts when new vulnerabilities affect Linux - before attackers find them.

Real-time alertsTrack your software stackFree plan available
Severity
MEDIUM5.5
Exploit prediction
EPSS 0.2%

Description

In the Linux kernel, the following vulnerability has been resolved: ACPI: APEI: send SIGBUS to current task if synchronous memory error not recovered If a synchronous error is detected as a result of user-space process triggering a 2-bit uncorrected error, the CPU will take a synchronous error exception such as Synchronous External Abort (SEA) on Arm64. The kernel will queue a memory_failure() work which poisons the related page, unmaps the page, and then sends a SIGBUS to the process, so that a system wide panic can be avoided. However, no memory_failure() work will be queued when abnormal synchronous errors occur. These errors can include situations like invalid PA, unexpected severity, no memory failure config support, invalid GUID section, etc. In such a case, the user-space process will trigger SEA again. This loop can potentially exceed the platform firmware threshold or even trigger a kernel hard lockup, leading to a system reboot. Fix it by performing a force kill if no memory_failure() work is queued for synchronous errors. [ rjw: Changelog edits ]

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

v < 6.6.1036.13 ≤ v < 6.15.116.16 ≤ v < 6.16.26.7 ≤ v < 6.12.435.4.695.88fcc4ae6faf8b455eeef00bc9ae70744e3b0f462af02933d59bd1621a48d8b0b331cca9e530ba14b
Vendor states this is fixed in 082735fbcdb6cd0cf20fbec94516ab2996f1cdd5 (fixed)
Vendor states this is fixed in 2fbc85da9ac9386bd89fcc94e0aadaea19d47784 (fixed)
Vendor states this is fixed in 3cb4f18797247985b0f51d5300f8cb6c78f343ea (fixed)
Vendor states this is fixed in 79a5ae3c4c5eb7e38e0ebe4d6bf602d296080060 (fixed)
Vendor states this is fixed in af089e41811a1ad6a7b2b80e839a73ec4c3cecdd (fixed)
Vendor states this is fixed in cfc9bc15bda6fd0c496cbe2c628564d4d7c332c1 (fixed)
Affected range stops below 5.5, so it looks safe — our inference, not a vendor statement
Vendor states this is fixed in 5.8 (unaffected)
Vendor states this is fixed in 6.1.164 (unaffected)
Vendor states this is fixed in 6.12.43 (unaffected)
Vendor states this is fixed in 6.15.11 (unaffected)
Vendor states this is fixed in 6.16.2 (unaffected)
Vendor states this is fixed in 6.17 (unaffected)
Vendor states this is fixed in 6.6.103 (unaffected)

CVSS

Attack Vector
LOCAL
Complexity
LOW
Privileges
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
NONE
Integrity
NONE
Availability
HIGH
Vector?

Quick Info

StatusANALYZED
CWE
NVD-CWE-noinfo

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Free plan, no card