High 7.1Published Sep 5, 2025

CVE-2025-39687iio: light: as73211: Ensure buffer holes are zeroed

Updated under an hour ago (Oct 28, 2026, 6:10 AM ET)

Does this affect you?

It affects Linux and 3 other products. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: iio: light: as73211: Ensure buffer holes are zeroed Given that the buffer is copied to a kfifo that ultimately user space can read, ensure we zero it.

CVSS: 7.1 HIGH (v3.1, NVD)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Modified
Record last updated: May 12, 2026
First seen by InfoSec Signals: Oct 19, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from 403e5586b52e466893ce3a7b7f3a3ecdc4c82d3e before fd441fd972067f80861a0b66605c0febb0d038dd; from 403e5586b52e466893ce3a7b7f3a3ecdc4c82d3e before d8c5d87a431596e0e02bd7fe3bff952b002a03bb; 403e5586b52e466893ce3a7b7f3a3ecdc4c82d3e builds before 83f14c4ca1ad78fcfb3e0de07d6d8a0c59550fc2; 403e5586b52e466893ce3a7b7f3a3ecdc4c82d3e builds before 99b508340d0d1b9de0856c48c77898b14c0df7cf; from 403e5586b52e466893ce3a7b7f3a3ecdc4c82d3e before cce55ca4e7a221d5eb2c0b757a868eacd6344e4a; 403e5586b52e466893ce3a7b7f3a3ecdc4c82d3e builds before 8acd9a0eaa8c9a28e385c0a6a56bb821cb549771; from 403e5586b52e466893ce3a7b7f3a3ecdc4c82d3e before 433b99e922943efdfd62b9a8e3ad1604838181f2	CNA record
Siemens SIMATIC CN 4100 siemens:simatic_cn_4100 (from the name)	before V5.0	CISA ADP
linux linux_kernel linux:linux_kernel	from 5.10 before 5.10.241; from 5.11 before 5.15.190; from 5.16 before 6.1.149; from 6.2 before 6.6.103; from 6.7 before 6.12.44; from 6.13 before 6.16.4; 6.17; 6.17	NVD
debian debian_linux debian:debian_linux	11.0	NVD

References

References

https://git.kernel.org/stable/c/fd441fd972067f80861a0b66605c0febb0d038dd	patch
https://git.kernel.org/stable/c/d8c5d87a431596e0e02bd7fe3bff952b002a03bb	patch
https://git.kernel.org/stable/c/83f14c4ca1ad78fcfb3e0de07d6d8a0c59550fc2	patch
https://git.kernel.org/stable/c/99b508340d0d1b9de0856c48c77898b14c0df7cf	patch
https://git.kernel.org/stable/c/cce55ca4e7a221d5eb2c0b757a868eacd6344e4a	patch
https://git.kernel.org/stable/c/8acd9a0eaa8c9a28e385c0a6a56bb821cb549771	patch
https://git.kernel.org/stable/c/433b99e922943efdfd62b9a8e3ad1604838181f2	patch
https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html	mailing-list, third-party-advisory
https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html	mailing-list, third-party-advisory
https://cert-portal.siemens.com/productcert/html/ssa-032379.html

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.