CVE-2025-39747: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-39747 is a NULL pointer dereference vulnerability in the Linux kernel's drm/msm (Direct Rendering Manager for Qualcomm Snapdragon) module, caused by missing error handling for krealloc failures in the msm_ioctl_gem_info_set_metadata() function. It affects Linux kernel versions from 3.12 up to (but not including) 6.12.43, 6.13.x through 6.15.10, and 6.16.x through 6.16.1. The vulnerability was published on September 11, 2025, with patches released shortly after. It carries a CVSS v3.1 base score of 5.5 (Medium) (Feedly, Microsoft MSRC).

The root cause is classified as CWE-476 (NULL Pointer Dereference). In msm_ioctl_gem_info_set_metadata(), a call to krealloc() for resizing a metadata buffer could return NULL on allocation failure, but the original code did not check for this condition before dereferencing the returned pointer. An attacker with low-privileged local access can trigger this code path to cause a kernel NULL pointer dereference. The fix adds an explicit check for krealloc() failure and returns -ENOMEM, and deliberately avoids using __GFP_NOFAIL due to deadlock risks in the kernel memory allocation context (Feedly, Kernel Patch).

Successful exploitation allows a local, low-privileged attacker to trigger a kernel crash (NULL pointer dereference), resulting in a denial of service (system crash or hang). The vulnerability has a high availability impact with no confidentiality or integrity impact, meaning it cannot be used to access or modify data but can render the affected system completely unavailable (Feedly). The scope is limited to the local system; lateral movement or data exfiltration are not applicable to this vulnerability.

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of this report (Feedly). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.018% (0.000180), indicating a very low probability of exploitation in the near term. Exploitation requires local access with at least low-privileged credentials, further limiting the attack surface.

Update the Linux kernel to a patched version: 6.12.43 or later (for the 3.12–6.12 branch), 6.15.11 or later (for the 6.13–6.15 branch), or 6.16.2 or later (for the 6.16 branch). Patches are available via the upstream kernel stable tree at git.kernel.org (Kernel Patch, Kernel Patch). As a short-term workaround, restrict local system access to trusted users to reduce exposure until kernel updates can be applied. Apply kernel updates from your Linux distribution's official repositories (e.g., Oracle Linux, Ubuntu, RHEL) as they become available.