CVE-2025-39719

Vulnerability

Overview

CVE-2025-39719 is a high-severity vulnerability in the Linux kernel's IIO subsystem, specifically in the BNO055 IMU driver. The bug resides in the bno055_getregmask() function, where the hw_xlate array is iterated using the length of the vals array instead of the length of hw_xlate itself. This mismatch can lead to an out-of-bounds (OOB) memory access when the vals array is larger than hw_xlate, as is the case with bno055_gyr_scale [1].

Exploitation

Conditions

Exploitation requires the kernel to be built-in IIO driver to be loaded and the device to be accessible. The vulnerability is triggered during normal operation when the driver attempts to translate a scale value via the hw_xlate table. In practice, a match is usually found before the loop exceeds the array bounds, but an attacker who can influence the scale value or the device's state could potentially force the loop to continue past the end of hw_xlate, causing an OOB read or write [1].

Impact

An out-of-bounds access in kernel memory can lead to information disclosure (reading sensitive data) or a system crash (denial of service). The CVSS v3 score of 7.1 indicates a moderate impact, but the vulnerability could be leveraged for privilege escalation if combined with other weaknesses. The fix introduces a new hw_xlate_len field to ensure the correct array size explicitly, preventing the OOB condition [1].

Mitigation

The Linux kernel stable tree has released patches that correct the iteration length. Users should update to a kernel version containing the commit that adds the hw_xlate_len field [2][3][4]. Siemens has also listed this CVE as affecting SIMATIC CN 4100 devices before V5.0, recommending an update to the latest firmware [1].