Linux: Incorrect Type Conversion or Cast
CVE-2025-39880 is a high-severity incorrect type conversion or cast vulnerability in Linux, with a CVSS 3.1 base score of 7.8 out of 10. It can be exploited with local access to the system by an attacker with a low-privileged account, without any action from a user. The record lists versions ea12ab684f8ae8a6da11a22c78d94a79e2163096, 591ea9c30737663a471b2bb07b27ddde86b020d5, 23538cfbeed87159a5ac6c61e7a6de3d8d4486a8 as the first without the flaw, so updating Linux to one of those releases or later removes the exposure. There is no confirmed exploitation so far. EPSS estimates a 0.33% chance of exploitation within 30 days, which is low compared with other CVEs.
High severity with no evidence of exploitation so far.
What to do
- Update Linux to ea12ab684f8ae8a6da11a22c78d94a79e2163096 or 591ea9c30737663a471b2bb07b27ddde86b020d5 or 23538cfbeed87159a5ac6c61e7a6de3d8d4486a8 or 35dbbc3dbf8bccb2d77c68444f42c1e6d2d27983, whichever matches your release line, or a later version.
- Update Linux Kernel to 5.15.194 or 6.1.153 or 6.6.107 or 6.12.48, whichever matches your release line, or a later version.
Affected products and versions
| Vendor | Product | Affected versions | Fixed in |
|---|---|---|---|
| Linux | Linux | cd1a677cad994021b19665ed476aea63f5d54f31 up to, but not including, ea12ab684f8ae8a6da11a22c78d94a79e2163096; cd1a677cad994021b19665ed476aea63f5d54f31 up to, but not including, 591ea9c30737663a471b2bb07b27ddde86b020d5; cd1a677cad994021b19665ed476aea63f5d54f31 up to, but not including, 23538cfbeed87159a5ac6c61e7a6de3d8d4486a8; cd1a677cad994021b19665ed476aea63f5d54f31 up to, but not including, 35dbbc3dbf8bccb2d77c68444f42c1e6d2d27983; cd1a677cad994021b19665ed476aea63f5d54f31 up to, but not including, 6bd8b56899be0b514945f639a89ccafb8f8dfaef; cd1a677cad994021b19665ed476aea63f5d54f31 up to, but not including, cdbc9836c7afadad68f374791738f118263c5371; 5.11 | ea12ab684f8ae8a6da11a22c78d94a79e2163096, 591ea9c30737663a471b2bb07b27ddde86b020d5, 23538cfbeed87159a5ac6c61e7a6de3d8d4486a8, 35dbbc3dbf8bccb2d77c68444f42c1e6d2d27983, 6bd8b56899be0b514945f639a89ccafb8f8dfaef, cdbc9836c7afadad68f374791738f118263c5371 |
| Linux | Linux Kernel | 5.11 up to, but not including, 5.15.194; 5.16 up to, but not including, 6.1.153; 6.2 up to, but not including, 6.6.107; 6.7 up to, but not including, 6.12.48; 6.13 up to, but not including, 6.16.8; 6.17 | 5.15.194, 6.1.153, 6.6.107, 6.12.48, 6.16.8 |
| Debian | Debian Linux | 11.0 | Not stated |
Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.
How the severity score breaks down
- Attack vector
- LocalThe attacker needs local access or must trick a user into running something.
- Attack complexity
- LowNo special conditions are needed; the attack works reliably.
- Privileges required
- LowA basic user account is enough.
- User interaction
- NoneNo action by a victim is required.
- Scope
- UnchangedImpact stays within the vulnerable component.
- Confidentiality
- HighAll data handled by the component can be read.
- Integrity
- HighData or code can be modified at will.
- Availability
- HighThe component can be taken down completely.
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. Scored by NVD.
| Scoring system | Score | Severity | Scored by |
|---|---|---|---|
| CVSS 3.1 | 9.8 | Critical | CNA |
| CVSS 3.1 | 7.8 | High | NVD |
Official description
In the Linux kernel, the following vulnerability has been resolved: libceph: fix invalid accesses to ceph_connection_v1_info There is a place where generic code in messenger.c is reading and another place where it is writing to con->v1 union member without checking that the union member is active (i.e. msgr1 is in use). On 64-bit systems, con->v1.auth_retry overlaps with con->v2.out_iter, so such a read is almost guaranteed to return a bogus value instead of 0 when msgr2 is in use. This ends up being fairly benign because the side effect is just the invalidation of the authorizer and successive fetching of new tickets. con->v1.connect_seq overlaps with con->v2.conn_bufs and the fact that it's being written to can cause more serious consequences, but luckily it's not something that happens often.
Source: the CVE record as published by its numbering authority, via NVD and CVE.org.
The underlying weakness: Incorrect Type Conversion or Cast
The product does not correctly convert an object, resource, or structure from one type to a different type.
More Incorrect Type Conversion or Cast vulnerabilities (CWE-704)
Timeline
- CVE record published.
- CISA published its SSVC assessment (exploitation: none, automatable: yes, technical impact: total).
- Record last changed materially (score, affected products, status or references).
References
Patches and release notes
- git.kernel.org/stable/c/23538cfbeed87159a5ac6c61e7a6de3d8d4486a8
- git.kernel.org/stable/c/35dbbc3dbf8bccb2d77c68444f42c1e6d2d27983
- git.kernel.org/stable/c/591ea9c30737663a471b2bb07b27ddde86b020d5
- git.kernel.org/stable/c/6bd8b56899be0b514945f639a89ccafb8f8dfaef
- git.kernel.org/stable/c/cdbc9836c7afadad68f374791738f118263c5371
- git.kernel.org/stable/c/ea12ab684f8ae8a6da11a22c78d94a79e2163096
Third-party and government advisories
- lists.debian.org/debian-lts-announce/2025/10/msg00008.htmlMailing List, Third Party Advisory
Recent Incorrect Type Conversion or Cast vulnerabilities
- 9.8 Critical severity
- 9.8 Critical severity
- 7.5 High severity
- 7.5 High severity
- 7.5 High severity
- 7.5 High severity
Spotted an error? Tell us.