{"api_version":"1","generated_at":"2026-07-23T10:49:57+00:00","cve":"CVE-2025-39701","urls":{"html":"https://cve.report/CVE-2025-39701","api":"https://cve.report/api/cve/CVE-2025-39701.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2025-39701","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2025-39701"},"summary":{"title":"ACPI: pfr_update: Fix the driver update version check","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nACPI: pfr_update: Fix the driver update version check\n\nThe security-version-number check should be used rather\nthan the runtime version check for driver updates.\n\nOtherwise, the firmware update would fail when the update binary had\na lower runtime version number than the current one.\n\n[ rjw: Changelog edits ]","state":"PUBLISHED","assigner":"Linux","published_at":"2025-09-05 18:15:47","updated_at":"2026-05-12 13:17:06"},"problem_types":["NVD-CWE-noinfo"],"metrics":[{"version":"3.1","source":"nvd@nist.gov","type":"Primary","score":"7.8","severity":"HIGH","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","data":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"}}],"references":[{"url":"https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html","name":"https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List","Third Party Advisory"],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/cf0a88124e357bffda487cbf3cb612bb97eb97e4","name":"https://git.kernel.org/stable/c/cf0a88124e357bffda487cbf3cb612bb97eb97e4","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/b00219888c11519ef75d988fa8a780da68ff568e","name":"https://git.kernel.org/stable/c/b00219888c11519ef75d988fa8a780da68ff568e","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/79300ff532bccbbf654992c7c0863b49a6c3973c","name":"https://git.kernel.org/stable/c/79300ff532bccbbf654992c7c0863b49a6c3973c","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-032379.html","name":"https://cert-portal.siemens.com/productcert/html/ssa-032379.html","refsource":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/908094681f645d3a78e18ef90561a97029e2df7b","name":"https://git.kernel.org/stable/c/908094681f645d3a78e18ef90561a97029e2df7b","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/8151320c747efb22d30b035af989fed0d502176e","name":"https://git.kernel.org/stable/c/8151320c747efb22d30b035af989fed0d502176e","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-39701","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-39701","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 0db89fa243e5edc5de38c88b369e4c3755c5fb74 79300ff532bccbbf654992c7c0863b49a6c3973c git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 0db89fa243e5edc5de38c88b369e4c3755c5fb74 cf0a88124e357bffda487cbf3cb612bb97eb97e4 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 0db89fa243e5edc5de38c88b369e4c3755c5fb74 b00219888c11519ef75d988fa8a780da68ff568e git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 0db89fa243e5edc5de38c88b369e4c3755c5fb74 908094681f645d3a78e18ef90561a97029e2df7b git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 0db89fa243e5edc5de38c88b369e4c3755c5fb74 8151320c747efb22d30b035af989fed0d502176e git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 5.17","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 5.17 semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.1.149 6.1.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.6.103 6.6.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.12.44 6.12.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.16.4 6.16.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.17 * original_commit_for_fix","platforms":[]},{"source":"ADP","vendor":"Siemens","product":"SIMATIC CN 4100","version":"affected V5.0 custom","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2025","cve_id":"39701","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"o","cpe4":"linux","cpe5":"linux_kernel","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"providerMetadata":{"dateUpdated":"2025-11-03T17:42:29.730Z","orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE"},"references":[{"url":"https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html"}],"title":"CVE Program Container"},{"affected":[{"defaultStatus":"unknown","product":"SIMATIC CN 4100","vendor":"Siemens","versions":[{"lessThan":"V5.0","status":"affected","version":"0","versionType":"custom"}]}],"providerMetadata":{"dateUpdated":"2026-05-12T12:06:23.158Z","orgId":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","shortName":"siemens-SADP"},"references":[{"url":"https://cert-portal.siemens.com/productcert/html/ssa-032379.html"}],"x_adpType":"supplier"}],"cna":{"affected":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/acpi/pfr_update.c","include/uapi/linux/pfrut.h"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"79300ff532bccbbf654992c7c0863b49a6c3973c","status":"affected","version":"0db89fa243e5edc5de38c88b369e4c3755c5fb74","versionType":"git"},{"lessThan":"cf0a88124e357bffda487cbf3cb612bb97eb97e4","status":"affected","version":"0db89fa243e5edc5de38c88b369e4c3755c5fb74","versionType":"git"},{"lessThan":"b00219888c11519ef75d988fa8a780da68ff568e","status":"affected","version":"0db89fa243e5edc5de38c88b369e4c3755c5fb74","versionType":"git"},{"lessThan":"908094681f645d3a78e18ef90561a97029e2df7b","status":"affected","version":"0db89fa243e5edc5de38c88b369e4c3755c5fb74","versionType":"git"},{"lessThan":"8151320c747efb22d30b035af989fed0d502176e","status":"affected","version":"0db89fa243e5edc5de38c88b369e4c3755c5fb74","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/acpi/pfr_update.c","include/uapi/linux/pfrut.h"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"5.17"},{"lessThan":"5.17","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.149","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.103","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.44","versionType":"semver"},{"lessThanOrEqual":"6.16.*","status":"unaffected","version":"6.16.4","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"6.17","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.1.149","versionStartIncluding":"5.17","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.6.103","versionStartIncluding":"5.17","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.12.44","versionStartIncluding":"5.17","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.16.4","versionStartIncluding":"5.17","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.17","versionStartIncluding":"5.17","vulnerable":true}],"negate":false,"operator":"OR"}]}],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nACPI: pfr_update: Fix the driver update version check\n\nThe security-version-number check should be used rather\nthan the runtime version check for driver updates.\n\nOtherwise, the firmware update would fail when the update binary had\na lower runtime version number than the current one.\n\n[ rjw: Changelog edits ]"}],"providerMetadata":{"dateUpdated":"2026-05-11T21:34:35.335Z","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux"},"references":[{"url":"https://git.kernel.org/stable/c/79300ff532bccbbf654992c7c0863b49a6c3973c"},{"url":"https://git.kernel.org/stable/c/cf0a88124e357bffda487cbf3cb612bb97eb97e4"},{"url":"https://git.kernel.org/stable/c/b00219888c11519ef75d988fa8a780da68ff568e"},{"url":"https://git.kernel.org/stable/c/908094681f645d3a78e18ef90561a97029e2df7b"},{"url":"https://git.kernel.org/stable/c/8151320c747efb22d30b035af989fed0d502176e"}],"title":"ACPI: pfr_update: Fix the driver update version check","x_generator":{"engine":"bippy-1.2.0"}}},"cveMetadata":{"assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","assignerShortName":"Linux","cveId":"CVE-2025-39701","datePublished":"2025-09-05T17:21:07.580Z","dateReserved":"2025-04-16T07:20:57.115Z","dateUpdated":"2026-05-12T12:06:23.158Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2025-09-05 18:15:47","lastModifiedDate":"2026-05-12 13:17:06","problem_types":["NVD-CWE-noinfo"],"metrics":{"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}]},"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.17","versionEndExcluding":"6.1.149","matchCriteriaId":"17F234E1-F0D0-46C2-8468-EF468C6127D8"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.2","versionEndExcluding":"6.6.103","matchCriteriaId":"F2293654-7169-49B5-8D0D-EE51EF8B8E48"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.7","versionEndExcluding":"6.12.44","matchCriteriaId":"12351F24-1133-4775-960C-F2B47E81298B"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.13","versionEndExcluding":"6.16.4","matchCriteriaId":"AFC28995-B8C3-4B68-8CB6-78E792B6629D"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:6.17:rc1:*:*:*:*:*:*","matchCriteriaId":"327D22EF-390B-454C-BD31-2ED23C998A1C"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:6.17:rc2:*:*:*:*:*:*","matchCriteriaId":"C730CD9A-D969-4A8E-9522-162AAF7C0EE9"}]}]},{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*","matchCriteriaId":"FA6FEEC2-9F11-4643-8827-749718254FED"}]}]}]},"legacy_mitre":{"record":{"CveYear":"2025","CveId":"39701","Ordinal":"1","Title":"ACPI: pfr_update: Fix the driver update version check","CVE":"CVE-2025-39701","Year":"2025"},"notes":[{"CveYear":"2025","CveId":"39701","Ordinal":"1","NoteData":"In the Linux kernel, the following vulnerability has been resolved:\n\nACPI: pfr_update: Fix the driver update version check\n\nThe security-version-number check should be used rather\nthan the runtime version check for driver updates.\n\nOtherwise, the firmware update would fail when the update binary had\na lower runtime version number than the current one.\n\n[ rjw: Changelog edits ]","Type":"Description","Title":"ACPI: pfr_update: Fix the driver update version check"}]}}}