Memory Access Vulnerability in Linux Kernel Affecting PCMCIADrivers

CVE-2025-39920

What is CVE-2025-39920?

This vulnerability arises in the Linux kernel's handling of memory during the validation of PCMCIA memory intervals. The function do_validate_mem() fails to account for errors returned from the add_interval() function. In scenarios where kmalloc() cannot allocate memory, a null pointer could be added to the linked list, leading to illegal memory access during subsequent calls to sub_interval(). Recent patches have introduced error handling to ensure that any failure in add_interval() results in an early exit with an appropriate error code, thus mitigating risks of vulnerabilities that can be exploited.

References