Medium 5.5Published Sep 12, 2025

CVE-2025-39794ARM: tegra: Use I/O memcpy to write to IRAM

Updated under an hour ago (Oct 27, 2026, 6:23 PM ET)

Does this affect you?

It affects Linux and 3 other products. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: ARM: tegra: Use I/O memcpy to write to IRAM Kasan crashes the kernel trying to check boundaries when using the normal memcpy.

CVSS: 5.5 MEDIUM (v3.1, NVD)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Modified
Record last updated: May 12, 2026
First seen by InfoSec Signals: Oct 19, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from b36ab9754efbd7429d214b3b03dc9843882571bd before b28c1a14accc79ead1e87bbdae53309da60be1e7; from b36ab9754efbd7429d214b3b03dc9843882571bd before 75a3bdfeed2f129a2c7d9fd7779382b78e35b014; from b36ab9754efbd7429d214b3b03dc9843882571bd before 2499b0ac908eefbb8a217aae609b7a5b5174f330; from b36ab9754efbd7429d214b3b03dc9843882571bd before 387435f4833f97aabfd74434ee526e31e8a626ea; from b36ab9754efbd7429d214b3b03dc9843882571bd before 46b3a7a3a36d5833f14914d1b95c69d28c6a76d6; from b36ab9754efbd7429d214b3b03dc9843882571bd before 9b0b3b5e5cae95e09bf0ae4a9bcb58d9b6d57f87; from b36ab9754efbd7429d214b3b03dc9843882571bd before 96d6605bf0561d6e568b1dd9265a0f73b5b94f51; from b36ab9754efbd7429d214b3b03dc9843882571bd before 30ef45b89a5961cdecf907ecff1ef3374d1de510; and 1 more ranges	CNA record
Siemens SIMATIC CN 4100 siemens:simatic_cn_4100 (from the name)	before V5.0	CISA ADP
linux linux_kernel linux:linux_kernel	from 3.4 before 5.4.297; from 5.5 before 5.10.241; from 5.11 before 5.15.190; from 5.16 before 6.1.149; from 6.2 before 6.6.103; from 6.7 before 6.12.43; from 6.13 before 6.15.11; from 6.16 before 6.16.2	NVD
debian debian_linux debian:debian_linux	11.0	NVD

References

References

https://git.kernel.org/stable/c/b28c1a14accc79ead1e87bbdae53309da60be1e7	patch
https://git.kernel.org/stable/c/75a3bdfeed2f129a2c7d9fd7779382b78e35b014	patch
https://git.kernel.org/stable/c/2499b0ac908eefbb8a217aae609b7a5b5174f330	patch
https://git.kernel.org/stable/c/387435f4833f97aabfd74434ee526e31e8a626ea	patch
https://git.kernel.org/stable/c/46b3a7a3a36d5833f14914d1b95c69d28c6a76d6	patch
https://git.kernel.org/stable/c/9b0b3b5e5cae95e09bf0ae4a9bcb58d9b6d57f87	patch
https://git.kernel.org/stable/c/96d6605bf0561d6e568b1dd9265a0f73b5b94f51	patch
https://git.kernel.org/stable/c/30ef45b89a5961cdecf907ecff1ef3374d1de510	patch
https://git.kernel.org/stable/c/398e67e0f5ae04b29bcc9cbf342e339fe9d3f6f1	patch
https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html	third-party-advisory
1–10 of 12

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.