Skip to content
Heist/ feed
High

soc: qcom: mdt_loader: Ensure we don't read past the ELF header

Type: advisorySource: Official CVE List1 source record

In the Linux kernel, the following vulnerability has been resolved: soc: qcom: mdt_loader: Ensure we don't read past the ELF header When the MDT loader is used in remoteproc, the ELF header is sanitized beforehand, but that's not necessary the case for other clients. Validate the size of the firmware buffer to ensure that we don't read past the end as we iterate over the header. e_phentsize and e_shentsize are validated as well, to ensure that the assumptions about step size in the traversal are valid.

Announced Source revision 1
Original source ↗

CVE-2025-39787

Primary source · Revision 1

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: cve:CVE-2025-39787

Linux

Source reference: /containers/cna/affected/0/product

Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

Linux

Source reference: /containers/cna/affected/1/product

Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

Structured affected-version data

Original package identities and version rules from this source.

[
  {
    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
    "vendor": "Linux",
    "product": "Linux",
    "versions": [
      {
        "status": "affected",
        "version": "2aad40d911eeb7dcac91c669f2762a28134f0eb1",
        "lessThan": "1096eb63ecfc8df90b70cd068e6de0c2ff204dfd",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "2aad40d911eeb7dcac91c669f2762a28134f0eb1",
        "lessThan": "e1720eb32acf411c328af6a8c8f556c94535808e",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "2aad40d911eeb7dcac91c669f2762a28134f0eb1",
        "lessThan": "0d59ce2bfc3bb13abe6240335a1bf7b96536d022",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "2aad40d911eeb7dcac91c669f2762a28134f0eb1",
        "lessThan": "43d26997d88c4056fce0324e72f62556bc7e8e8d",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "2aad40d911eeb7dcac91c669f2762a28134f0eb1",
        "lessThan": "981c845f29838e468a9bfa87f784307193a31297",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "2aad40d911eeb7dcac91c669f2762a28134f0eb1",
        "lessThan": "87bfabb3b2f46827639173f143aa43f7cfc0a7e6",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "2aad40d911eeb7dcac91c669f2762a28134f0eb1",
        "lessThan": "81278be4eb5f08ba2c68c3055893e61cc03727fe",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "2aad40d911eeb7dcac91c669f2762a28134f0eb1",
        "lessThan": "9f9967fed9d066ed3dae9372b45ffa4f6fccfeef",
        "versionType": "git"
      }
    ],
    "programFiles": [
      "drivers/soc/qcom/mdt_loader.c"
    ],
    "defaultStatus": "unaffected"
  },
  {
    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
    "vendor": "Linux",
    "product": "Linux",
    "versions": [
      {
        "status": "affected",
        "version": "4.11"
      },
      {
        "status": "unaffected",
        "version": "0",
        "lessThan": "4.11",
        "versionType": "semver"
      },
      {
        "status": "unaffected",
        "version": "5.4.297",
        "versionType": "semver",
        "lessThanOrEqual": "5.4.*"
      },
      {
        "status": "unaffected",
        "version": "5.10.241",
        "versionType": "semver",
        "lessThanOrEqual": "5.10.*"
      },
      {
        "status": "unaffected",
        "version": "5.15.190",
        "versionType": "semver",
        "lessThanOrEqual": "5.15.*"
      },
      {
        "status": "unaffected",
        "version": "6.1.149",
        "versionType": "semver",
        "lessThanOrEqual": "6.1.*"
      },
      {
        "status": "unaffected",
        "version": "6.6.103",
        "versionType": "semver",
        "lessThanOrEqual": "6.6.*"
      },
      {
        "status": "unaffected",
        "version": "6.12.44",
        "versionType": "semver",
        "lessThanOrEqual": "6.12.*"
      },
      {
        "status": "unaffected",
        "version": "6.16.4",
        "versionType": "semver",
        "lessThanOrEqual": "6.16.*"
      },
      {
        "status": "unaffected",
        "version": "6.17",
        "versionType": "original_commit_for_fix",
        "lessThanOrEqual": "*"
      }
    ],
    "programFiles": [
      "drivers/soc/qcom/mdt_loader.c"
    ],
    "defaultStatus": "affected"
  }
]
Related CVEs
CVE-2025-39787

Source reference: /cveMetadata/cveId

Publisher severity

high

Source reference: /containers/cna/metrics

Event
#27068 · Revision 1
Added to Heist Feed
Publisher date
Read the original announcement