CVE-2025-39809: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-39809 is a stack-out-of-bounds write vulnerability in the Linux kernel's Intel QuickI2C (intel-thc-hid) ACPI driver. The flaw arises because the QuickI2C ACPI _DSD methods return ICRS and ISUB data with a trailing byte, making the actual data length one byte larger than the defined structs, triggering a kernel crash via KASAN-detected out-of-bounds write. Affected versions are Linux kernel 6.14 through 6.16.4, and release candidates 6.17-rc1 through 6.17-rc3. It was published on September 16, 2025, with a CVSS v3.1 base score of 7.8 (High) (Red Hat Advisory, Red Hat Bugzilla).

The root cause is an out-of-bounds write (CWE-787) in the quicki2c_acpi_get_dsd_property() function within the intel_quicki2c kernel module. When the ACPI _DSD methods return ICRS and ISUB buffers, each contains a trailing byte not accounted for in the corresponding C structs (quicki2c_subip_acpi_parameter/config), causing __asan_memcpy to write 12 bytes into a stack region only sized for 11 bytes (offset 48, frame object i2c_param at [48, 59)). Exploitation requires low-privileged local access to a system with the affected Intel THC/QuickI2C hardware and driver loaded. The fix adds reserved padding to the relevant structs to accommodate the extra trailing byte (Red Hat Bugzilla, Kernel Patch 1).

Successful exploitation can cause an immediate kernel crash (denial of service) due to the stack-out-of-bounds write detected by KASAN. Beyond a crash, the memory corruption could theoretically be leveraged by a local attacker with low privileges to achieve arbitrary code execution in kernel context, resulting in full system compromise with high confidentiality, integrity, and availability impact. The vulnerability is limited to systems running the affected kernel versions with Intel THC/QuickI2C hardware present (Red Hat Advisory, Red Hat Bugzilla).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is very low at approximately 0.018%, reflecting the limited attack surface (hardware-specific, local access required). No threat actor attribution has been reported (Red Hat Advisory).

• Logs: KASAN kernel messages such as BUG: KASAN: stack-out-of-bounds in quicki2c_acpi_get_dsd_property.constprop.0 in /var/log/kern.log or dmesg output.
• Logs: Kernel panic or oops traces referencing intel_quicki2c module, quicki2c_get_acpi_resources, or __asan_memcpy in kernel logs.
• Process: Unexpected kernel worker crashes associated with kworker tasks running async_run_entry_fn during device initialization.
• File System: Presence of kernel crash dumps (e.g., /var/crash/) generated during system boot or device enumeration on systems with Intel THC hardware (Red Hat Bugzilla).

Update to Linux kernel version 6.16.5 or later, which includes the fix adding reserved padding to the quicki2c_subip_acpi_parameter and related structs. Patches are available via the upstream kernel stable tree (commits 1db9df89a213 and 4adce86d4b13). As a workaround where patching is not immediately possible, restrict local system access to trusted users and consider blacklisting the intel_quicki2c module on affected hardware if the functionality is not required (echo 'blacklist intel_quicki2c' >> /etc/modprobe.d/blacklist.conf) (Red Hat Advisory, Kernel Patch 1, Kernel Patch 2).