CVE-2025-39954: 
Linux Debian vulnerability analysis and mitigation

CVE-2025-39954 is a vulnerability discovered in the Linux kernel's clock subsystem, specifically in the sunxi-ng MP clock driver. The vulnerability was disclosed on October 9, 2025, affecting the dual-divider clock rate readback functionality (NVD, RedHat).

The vulnerability stems from an implementation error in the .recalc_rate readback function where the P divider offset was omitted during the dual-divider clock support implementation. This oversight causes the clock rate calculations to become incorrect or potentially zero when the P divider is 1, leading to a possible divide-by-zero condition. The issue has been assigned a CVSS v3.1 base score of 5.5 with the vector string AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H (RedHat).

The vulnerability can cause the clock rate to become bogus or zero, potentially affecting system stability and performance. The impact is primarily focused on availability, with no direct effects on confidentiality or integrity (NVD).

The vulnerability has been fixed by incorporating the P divider offset into the calculation within the .recalc_rate readback function. The fix has been implemented in the Linux kernel, and various distributions have either patched their kernels or marked their versions as not affected (Ubuntu).