CVE-2025-39823: debian linux — Fix

Description

In the Linux kernel, the following vulnerability has been resolved: KVM: x86: use array_index_nospec with indices that come from guest min and dest_id are guest-controlled indices. Using array_index_nospec() after the bounds checks clamps these values to mitigate speculative execution side-channels.

Is your site exposed to CVE-2025-39823?

Run a free security scan — no signup, results in seconds.

CVSS v3.1 Score

7.8

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness Type (CWE)

CWE-129 CWE-129

Affected Products

Vendor	Product	Versions
linux	linux_kernel	4.19 — 5.4.298
linux	linux_kernel	5.5 — 5.10.242
linux	linux_kernel	5.11 — 5.15.191
linux	linux_kernel	5.16 — 6.1.150
linux	linux_kernel	6.2 — 6.6.104
linux	linux_kernel	6.7 — 6.12.45
linux	linux_kernel	6.13 — 6.16.5
linux	linux_kernel	All
linux	linux_kernel	All
linux	linux_kernel	All
debian	debian_linux	All

References

Advisories & Patches

https://git.kernel.org/stable/c/31a0ad2f60cb4816e06218b63e695eb72ce74974 https://git.kernel.org/stable/c/33e974c2d5a82b2f9d9ba0ad9cbaabc1c8e3985f https://git.kernel.org/stable/c/67a05679621b7f721bdba37a5d18665d3aceb695 https://git.kernel.org/stable/c/72777fc31aa7ab2ce00f44bfa3929c6eabbeaf48 https://git.kernel.org/stable/c/c87bd4dd43a624109c3cc42d843138378a7f4548 https://git.kernel.org/stable/c/d51e381beed5e2f50f85f49f6c90e023754efa12 https://git.kernel.org/stable/c/f49161646e03d107ce81a99c6ca5da682fe5fb69 https://git.kernel.org/stable/c/f57a4bd8d6cb5af05b8ac1be9098e249034639fb

Other References

https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html https://cert-portal.siemens.com/productcert/html/ssa-032379.html

Frequently Asked Questions

What is CVE-2025-39823? +

In the Linux kernel, the following vulnerability has been resolved: KVM: x86: use array_index_nospec with indices that come from guest min and dest_id are guest-controlled indices. Using array_index_nospec() after the bounds checks clamps these values to mitigate speculative execution side-channels. It has a CVSS v3.1 base score of 7.8 (HIGH).

How severe is CVE-2025-39823? +

CVE-2025-39823 has a CVSS v3.1 score of 7.8 out of 10, rated HIGH. This is a high-severity vulnerability that should be prioritized for patching.

What products are affected by CVE-2025-39823? +

CVE-2025-39823 affects products from debian, linux, specifically: debian_linux, linux_kernel. Check the affected products table above for specific version ranges.

How do I check if I'm vulnerable to CVE-2025-39823? +

You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.

Related Vulnerabilities

CVE-2025-0657

A weakness in Automated Logic and Carrier i-Vu Gen5 router on driver version drv_gen5_106-01-2380, allows malformed packets to be sent …

CVE-2025-66559

Taiko Alethia is an Ethereum-equivalent, permissionless, based rollup designed to scale Ethereum without compromising its fundamental properties. In 2.3.1 and …

CVE-2023-31309

Improper validation in Power Management Firmware (PMFW) may allow an attacker with privileges to pass malformed workload arguments when exporting …

CVE-2026-19318

A stack-based buffer overflow vulnerability in the WatchGuard Fireware OS iked process allows a remote unauthenticated attacker to execute arbitrary …

CVE-2026-84445

gRPC-Go is the Go language implementation of gRPC. Prior to 1.82.2 and 1.83.2, servers created with xds.NewGRPCServer() allow internal/transport/http2_server.go to …

CVE-2026-57159

PJSIP is a free and open source multimedia communication library written in C. Prior to commit 673b978, a remote out-of-bounds …

CVE-2025-39823