CVE-2025-39787

The vulnerability resides in the Qualcomm mdt_loader driver within the Linux kernel. The loader iterates over the ELF header of a firmware image to locate program and section headers. The patch description states that while the remoteproc subsystem sanitizes the ELF header beforehand, other clients may not. Without a validation of the firmware buffer size against the header fields e_phentsize and e_shentsize, the traversal could read past the end of the allocated buffer. [1]

An attacker who can supply a crafted firmware image to a kernel component that invokes the MDT loader could trigger an out-of-bounds read. The attack does not require authentication if the attacker can control the firmware blob (e.g., via a malicious module or file system). The prerequisite is that the kernel must call the vulnerable functions without having pre-validated the header. [1]

The impact is that the kernel may read memory beyond the firmware buffer, potentially causing an information leak (disclosure of sensitive kernel memory) or a system crash (denial of service). The CVSS v3 base score of 5.5 reflects a medium severity with primarily confidentiality and availability impacts. [1]

A fix has been committed to the Linux kernel stable trees. The patch adds checks to ensure that the ELF header and its sub-fields fit within the firmware buffer before iterating. Users should apply the latest kernel updates. Siemens has listed this CVE among many others affecting their industrial products, indicating that a kernel update is the recommended remediation for those platforms. [1][2]