Medium 5.5Published Sep 19, 2025

CVE-2025-39846pcmcia: Fix a NULL pointer dereference in __iodyn_find_io_region()

Updated under an hour ago (Oct 27, 2026, 3:30 AM ET)

Does this affect you?

It affects Linux and 19 other products. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: pcmcia: Fix a NULL pointer dereference in __iodyn_find_io_region() In __iodyn_find_io_region(), pcmcia_make_resource() is assigned to res and used in pci_bus_alloc_resource(). There is a dereference of res in pci_bus_alloc_resource(), which could lead to a NULL pointer dereference on failure of pcmcia_make_resource(). Fix this bug by adding a check of res.

CVSS: 5.5 MEDIUM (v3.1, NVD)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Modified
Record last updated: May 12, 2026
First seen by InfoSec Signals: Oct 19, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from 49b1153adfe18a3cce7e70aa26c690f275917cd0 before b990c8c6ff50649ad3352507398e443b1e3527b2; 49b1153adfe18a3cce7e70aa26c690f275917cd0 builds before 5ff2826c998370bf7f9ae26fe802140d220e3510; 49b1153adfe18a3cce7e70aa26c690f275917cd0 builds before 4bd570f494124608a0696da070f00236a96fb610; from 49b1153adfe18a3cce7e70aa26c690f275917cd0 before ce3b7766276894d2fbb07e2047a171f9deb965de; 49b1153adfe18a3cce7e70aa26c690f275917cd0 builds before 2ee32c4c4f636e474cd8ab7c19a68cf36072ea93; from 49b1153adfe18a3cce7e70aa26c690f275917cd0 before fafa7450075f41d232bc785a4ebcbf16374f2076; from 49b1153adfe18a3cce7e70aa26c690f275917cd0 before d7286005e8fde0a430dc180a9f46c088c7d74483; from 49b1153adfe18a3cce7e70aa26c690f275917cd0 before 44822df89e8f3386871d9cad563ece8e2fd8f0e7	CNA record
Siemens RUGGEDCOM RST2428P siemens:ruggedcom_rst2428p (from the name)	before V3.3	CISA ADP
Siemens SCALANCE XC-300/XR-300/XC-400/XR-500WG/XR-500 family siemens:scalance_xc_300_xr_300_xc_400_xr_500wg_xr_500_family (from the name)	before V3.3	CISA ADP
Siemens SCALANCE XCH328 siemens:scalance_xch328 (from the name)	before V3.3	CISA ADP
Siemens SCALANCE XCM324 siemens:scalance_xcm324 (from the name)	before V3.3	CISA ADP
Siemens SCALANCE XCM328 siemens:scalance_xcm328 (from the name)	before V3.3	CISA ADP
Siemens SCALANCE XCM332 siemens:scalance_xcm332 (from the name)	before V3.3	CISA ADP
Siemens SCALANCE XRH334 (24 V DC, 8xFO, CC) siemens:scalance_xrh334_24_v_dc_8xfo_cc (from the name)	before V3.3	CISA ADP
Siemens SCALANCE XRM334 (230 V AC, 12xFO) siemens:scalance_xrm334_230_v_ac_12xfo (from the name)	before V3.3	CISA ADP
Siemens SCALANCE XRM334 (230 V AC, 8xFO) siemens:scalance_xrm334_230_v_ac_8xfo (from the name)	before V3.3	CISA ADP
1–10 of 20

References

References

https://git.kernel.org/stable/c/b990c8c6ff50649ad3352507398e443b1e3527b2	patch
https://git.kernel.org/stable/c/5ff2826c998370bf7f9ae26fe802140d220e3510	patch
https://git.kernel.org/stable/c/4bd570f494124608a0696da070f00236a96fb610	patch
https://git.kernel.org/stable/c/ce3b7766276894d2fbb07e2047a171f9deb965de	patch
https://git.kernel.org/stable/c/2ee32c4c4f636e474cd8ab7c19a68cf36072ea93	patch
https://git.kernel.org/stable/c/fafa7450075f41d232bc785a4ebcbf16374f2076	patch
https://git.kernel.org/stable/c/d7286005e8fde0a430dc180a9f46c088c7d74483	patch
https://git.kernel.org/stable/c/44822df89e8f3386871d9cad563ece8e2fd8f0e7	patch
https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html	mailing-list, third-party-advisory
https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html	mailing-list, third-party-advisory
1–10 of 12

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.