CVE-2025-39724: Linux kernel · serial: 8250: fix panic due to PSLVERR
Affects Linux kernelSource CVE Database V5
Not known to be exploited · fixed in cb7b3633ed749db8e56f475f43c960652cbd6882 : update Linux kernel when convenient.
Data as of 5 Nov 2026, 21:48 UTC
Rated Medium by Threat Radar's AI analysis · No CVSS score from NVD or the CNA
Thin evidence
One scorer or none- CISA SSVC
- Exploitation
- No evidence of active exploitation and no public proof of concept
- Automatable
- Attackers cannot reliably automate steps 1–4 of the kill chain
- Technical impact
- Limited control over the software or limited information exposure
CISA SSVC assessment, 2026-11-05.
- Patch
- Available – fixed in cb7b3633ed749db8e56f475f43c960652cbd6882, c826943abf473a3f7260fbadfad65e44db475460, b8ca8e3f75ede308b4d49a6ca5081460be01bdb5 +7
Exploitation evidence
Disclosed: evidence found.
CVE published 5 Sep 2025
Detectable: no evidence on record.
No public nuclei template indexed
Weaponized: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 5 Nov 2026.
What to do
Upgrade to a fixed release listed under Affected software.
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| LinuxLinux | Affected
| Fixed in
|
| LinuxLinux | Affected
| Fixed in– |
AI-suggested
This issue is fixed in Linux kernel versions 3.11, 3.13, and corresponding commits. Users should upgrade to these fixed versions or later to remediate the vulnerability. No additional mitigation is required once patched.
Description
A vulnerability in the Linux kernel's serial 8250 driver could cause a kernel panic due to an error response triggered when reading an empty Receive Buffer Register (RBR) with FIFO enabled. The issue arises from a race condition involving concurrent UART access across CPUs, leading to a panic. The flaw is fixed by adding a lock around the UART line control register write operation.
References
- git.kernel.org/stable/c/0b882f00655afefbc7729c6b5aec86f7a5473a3d (opens in a new tab)
- git.kernel.org/stable/c/b8ca8e3f75ede308b4d49a6ca5081460be01bdb5 (opens in a new tab)
- git.kernel.org/stable/c/68c4613e89f000e8198f9ace643082c697921c9f (opens in a new tab)
- git.kernel.org/stable/c/c826943abf473a3f7260fbadfad65e44db475460 (opens in a new tab)
- git.kernel.org/stable/c/cb7b3633ed749db8e56f475f43c960652cbd6882 (opens in a new tab)
- git.kernel.org/stable/c/8e2739478c164147d0774802008528d9e03fb802 (opens in a new tab)
- git.kernel.org/stable/c/38c0ea484dedb58cb3a4391229933e16be0d1031 (opens in a new tab)
- git.kernel.org/stable/c/7f8fdd4dbffc05982b96caf586f77a014b2a9353 (opens in a new tab)
- lists.debian.org/debian-lts-announce/2025/10/msg00008.html (opens in a new tab)
- lists.debian.org/debian-lts-announce/2025/10/msg00007.html (opens in a new tab)
- cert-portal.siemens.com/productcert/html/ssa-082556.html (opens in a new tab)
- cert-portal.siemens.com/productcert/html/ssa-032379.html (opens in a new tab)