CVE-2025-39998 describes a buffer overflow vulnerability in the Linux kernel's target_core_configfs driver, specifically in the target_lu_gp_members_show function. The function uses snprintf to format a string containing HBA and device names into a fixed-size 256-byte buffer. Since snprintf returns the total length of the formatted string regardless of truncation, the subsequent memcpy call uses this length without verifying it fits in the buffer, causing a buffer overflow. The vulnerability is mitigated by adding a length check on snprintf's return value to prevent overflow.

The vulnerability can lead to a buffer overflow condition in the kernel, which may result in denial of service (kernel crash) or potential exposure of sensitive information (confidentiality impact). The CVSS vector indicates local attack vector with low complexity and low privileges required, no user interaction, and high confidentiality and availability impact. There is no indication of known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The vulnerability description states it has been resolved by adding a length check to avoid buffer overflow, implying an official fix exists. Users should monitor Linux kernel updates and apply the relevant patches once available. No additional mitigation steps are specified in the provided data.