VulnerabilityPublished 9 Oct 2025Updated 21 Oct 2026

CVE-2025-39958: Linux kernel · iommu/s390: Make attach succeed when the device was surprise removed

Affects Linux kernelSource CVE Database V5

Not known to be exploited · fixed in 359613f2fa009587154511e4842e8ab9532edd15 : update Linux kernel when convenient.

Data as of 26 Oct 2026, 14:18 UTC

Severity

Unrated

Rated by Threat Radar · No CVSS score from NVD or the CNA

EPSS: 0.1% chance of exploitation in 30 days – higher than 8% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
Patch: Available – fixed in 359613f2fa009587154511e4842e8ab9532edd15, 79fa3a19aa6114189b33e2ba1f393b0f635d7544, 9ffaf5229055fcfbb3b3d6f1c7e58d63715c3f73 +1

Exploitation evidence

Disclosed: evidence found.
CVE published 9 Oct 2025
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponised: Public exploit code exists in Metasploit or Exploit-DB, or CISA SSVC or the CVSS exploit maturity reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

What to do

Upgrade Linux kernel to 359613f2fa009587154511e4842e8ab9532edd15, 79fa3a19aa6114189b33e2ba1f393b0f635d7544, 9ffaf5229055fcfbb3b3d6f1c7e58d63715c3f73 or 3b32cf6e279597d1b6477fb89d46abf65263c139.

Affected software

Product	Affected	Fixed in
LinuxLinux	Affected ≥ 59bbf596791b89c7f88fdcac29dfc39c1221d25d, < 359613f2fa009587154511e4842e8ab9532edd15	Fixed in 359613f2fa009587154511e4842e8ab9532edd15
LinuxLinux	Affected ≥ 59bbf596791b89c7f88fdcac29dfc39c1221d25d, < 79fa3a19aa6114189b33e2ba1f393b0f635d7544	Fixed in 79fa3a19aa6114189b33e2ba1f393b0f635d7544
LinuxLinux	Affected ≥ 59bbf596791b89c7f88fdcac29dfc39c1221d25d, < 9ffaf5229055fcfbb3b3d6f1c7e58d63715c3f73	Fixed in 9ffaf5229055fcfbb3b3d6f1c7e58d63715c3f73
LinuxLinux	Affected ≥ 59bbf596791b89c7f88fdcac29dfc39c1221d25d, < 3b32cf6e279597d1b6477fb89d46abf65263c139	Fixed in 3b32cf6e279597d1b6477fb89d46abf65263c139
LinuxLinux	Affected =6.2	Fixed in–

Description

In the Linux kernel, the following vulnerability has been resolved: iommu/s390: Make attach succeed when the device was surprise removed When a PCI device is removed with surprise hotplug, there may still be attempts to attach the device to the default domain as part of tear down via (__iommu_release_dma_ownership()), or because the removal happens during probe (__iommu_probe_device()). In both cases zpci_register_ioat() fails with a cc value indicating that the device handle is invalid. This is because the device is no longer part of the instance as far as the hypervisor is concerned. Currently this leads to an error return and s390_iommu_attach_device() fails. This triggers the WARN_ON() in __iommu_group_set_domain_nofail() because attaching to the default domain must never fail. With the device fenced by the hypervisor no DMAs to or from memory are possible and the IOMMU translations have no effect. Proceed as if the registration was successful and let the hotplug event handling clean up the device. This is similar to how devices in the error state are handled since commit 59bbf596791b ("iommu/s390: Make attach succeed even if the device is in error state") except that for removal the domain will not be registered later. This approach was also previously discussed at the link. Handle both cases, error state and removal, in a helper which checks if the error needs to be propagated or ignored. Avoid magic number condition codes by using the pre-existing, but never used, defines for PCI load/store condition codes and rename them to reflect that they apply to all PCI instructions.

References

Community reviews

Loading reviews…