CVE-2025-39907: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-39907 is a vulnerability discovered in the Linux kernel affecting the MTD (Memory Technology Device) subsystem, specifically in the STM32 FMC2 NAND controller driver. The vulnerability was disclosed on October 1, 2025, and involves overlapping DMA mappings in the ECC buffer (NVD, Red Hat).

The vulnerability occurs in the stm32fmc2nfc driver where overlapping DMA mappings on the ECC buffer can trigger system warnings and potential stability issues. The issue manifests when the DMA-API encounters overlapping mappings that aren't supported by the cacheline tracking system. This has been assigned a CVSS v3.1 score of 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), indicating moderate severity (Red Hat).

The vulnerability primarily affects system stability and can potentially lead to high availability impacts on affected systems. The issue is particularly relevant for systems using the STM32MP257F hardware platform with the FMC2 NAND controller (Red Hat).

The issue has been resolved by implementing a fix that uses a contiguous non-cacheable buffer to avoid overlapping mappings. This solution has been incorporated into the Linux kernel codebase (NVD).