CVE-2025-39701

Vulnerability

Analysis

CVE-2025-39701 is a vulnerability in the Linux kernel's ACPI pfr_update driver, where the kernel's firmware update path performed a version check using the wrong value. Specifically, the driver used the runtime version number instead of the security-version-number when validating driver updates [1][2]. This flaw was introduced in the kernel's handling of Platform Firmware Runtime Update and was addressed by kernel stable backports [3][4].

Attack

Vector

The bug is triggered during the firmware update process. When a user or system attempts to apply a driver update binary, the kernel compares the binary's version against the currently installed firmware version. Because the incorrect version field was checked, an update that has a lower runtime version number than the current runtime version would be rejected, even if the security version met the necessary criteria. This prevents legitimate security updates from being applied. The vulnerability is exploitable locally by an attacker with sufficient privileges to initiate a platform firmware update (which typically requires root access). However, the more direct impact is on the integrity of the update mechanism itself.

Impact

The primary consequence is denial of service for firmware updates: a legitimate update may fail to install, leaving the system running outdated firmware. If an attacker can control the update binary, they might also craft a binary with a high runtime version that bypasses security version requirements, potentially downgrading security protections. The CVE is rated High (CVSS 7.8) due to the potential for local privilege escalation or compromise of firmware integrity [2], though the description emphasizes the update failure scenario.

Mitigation

Linux kernel stable releases have been patched to use the security-version-number for the driver update check, as seen in multiple stable kernel commits [3][4]. Users should update their kernel to a version containing the fix (e.g., commit b00219888c11 or any later backport). The Siemens advisory lists this CVE as affecting SIMATIC CN 4100 devices, with all versions before V5.0 being impacted. For affected products, apply the vendor-supplied firmware update when available [1].