High 7.8Published Sep 11, 2025

CVE-2025-39788scsi: ufs: exynos: Fix programming of HCI_UTRL_NEXUS_TYPE

Updated under an hour ago (Oct 26, 2026, 12:50 PM ET)

Does this affect you?

It affects Linux and 3 other products. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: scsi: ufs: exynos: Fix programming of HCI_UTRL_NEXUS_TYPE On Google gs101, the number of UTP transfer request slots (nutrs) is 32, and in this case the driver ends up programming the UTRL_NEXUS_TYPE incorrectly as 0. This is because the left hand side of the shift is 1, which is of type int, i.e. 31 bits wide. Shifting by more than that width results in undefined behaviour. Fix this by switching to the BIT() macro, which applies correct type casting as required. This ensures the correct value is written to UTRL_NEXUS_TYPE (0xffffffff on gs101), and it also fixes a UBSAN shift warning: UBSAN: shift-out-of-bounds in drivers/ufs/host/ufs-exynos.c:1113:21 shift exponent 32 is too large for 32-bit type 'int' For consistency, apply the same change to the nutmrs / UTMRL_NEXUS_TYPE write.

CVSS: 7.8 HIGH (v3.1, NVD)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Modified
Record last updated: May 12, 2026
First seen by InfoSec Signals: Oct 19, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from 55f4b1f73631a0817717fe6e98517de51b4c3527 before 01510a9e8222f11cce064410f3c2fcf0756c0a08; from 55f4b1f73631a0817717fe6e98517de51b4c3527 before 098b2c8ee208c77126839047b9e6e1925bb35baa; from 55f4b1f73631a0817717fe6e98517de51b4c3527 before c1f025da8f370a015e412b55cbcc583f91de8316; 55f4b1f73631a0817717fe6e98517de51b4c3527 builds before 6d53b2a134da77eb7fe65c5c7c7a3c193539a78a; from 55f4b1f73631a0817717fe6e98517de51b4c3527 before dc8fb963742f1a38d284946638f9358bdaa0ddee; 55f4b1f73631a0817717fe6e98517de51b4c3527 builds before 5b9f1ef293428ea9c0871d96fcec2a87c4445832; 55f4b1f73631a0817717fe6e98517de51b4c3527 builds before 01aad16c2257ab8ff33b152b972c9f2e1af47912	CNA record
Siemens SIMATIC CN 4100 siemens:simatic_cn_4100 (from the name)	before V5.0	CISA ADP
linux linux_kernel linux:linux_kernel	from 5.9 before 5.10.241; from 5.11 before 5.15.190; from 5.16 before 6.1.149; from 6.2 before 6.6.103; from 6.7 before 6.12.44; from 6.13 before 6.16.4	NVD
debian debian_linux debian:debian_linux	11.0	NVD

References

References

https://git.kernel.org/stable/c/01510a9e8222f11cce064410f3c2fcf0756c0a08	patch
https://git.kernel.org/stable/c/098b2c8ee208c77126839047b9e6e1925bb35baa	patch
https://git.kernel.org/stable/c/c1f025da8f370a015e412b55cbcc583f91de8316	patch
https://git.kernel.org/stable/c/6d53b2a134da77eb7fe65c5c7c7a3c193539a78a	patch
https://git.kernel.org/stable/c/dc8fb963742f1a38d284946638f9358bdaa0ddee	patch
https://git.kernel.org/stable/c/5b9f1ef293428ea9c0871d96fcec2a87c4445832	patch
https://git.kernel.org/stable/c/01aad16c2257ab8ff33b152b972c9f2e1af47912	patch
https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html	third-party-advisory
https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html	third-party-advisory
https://cert-portal.siemens.com/productcert/html/ssa-032379.html

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.