CVE-2025-39809: Linux Kernel Buffer Overflow Vulnerability

CVE-2025-39809 Overview

CVE-2025-39809 is a stack out-of-bounds write vulnerability in the Linux kernel's intel-thc-hid: intel-quicki2c driver. The flaw resides in the quicki2c_acpi_get_dsd_property function, which reads ICRS and ISUB data from ACPI _DSD methods. The QuickI2C ACPI methods return these buffers with a trailing byte, causing the actual length to exceed the size of the destination structs by one byte. When the driver invokes memcpy into the on-stack i2c_param and i2c_config objects, the write overflows adjacent stack memory. KASAN traps the overflow as a stack out-of-bounds write, and the kernel crashes.

Critical Impact
A local attacker with the ability to influence ACPI DSD data or trigger the affected driver path can cause a kernel crash and potentially corrupt kernel stack memory, leading to denial of service or local privilege escalation.

Affected Products

Linux kernel 6.17-rc1
Linux kernel 6.17-rc2
Linux kernel 6.17-rc3

Discovery Timeline

2025-09-16 - CVE-2025-39809 published to NVD
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2025-39809

Vulnerability Analysis

The vulnerability is a stack-based out-of-bounds write [CWE-787] in the intel_quicki2c HID driver. During probe, quicki2c_get_acpi_resources allocates the i2c_param and i2c_config structures on the kernel stack, then calls quicki2c_acpi_get_dsd_property to populate them from ACPI _DSD output buffers. The driver assumes the ICRS and ISUB buffers match the struct sizes exactly. However, firmware returns 12 bytes for ICRS where the struct expects 11, and returns a padded ISUB buffer as well. The __asan_memcpy call therefore writes past the end of the stack allocation, corrupting stack canaries and adjacent frame objects.

Root Cause

The root cause is a size mismatch between the quicki2c_subip_acpi_parameter and quicki2c_subip_acpi_config struct definitions and the actual ACPI _DSD buffer layout. ACPI firmware appends a trailing byte to the returned buffers. The driver copies the full buffer length into a smaller destination without bounds validation. The fix adds a reserved padding byte to each struct so the destination matches the buffer size returned by ACPI.

Attack Vector

Exploitation requires local access with the ability to load or interact with the intel_quicki2c driver on affected 6.17-rc kernels. Systems shipping with Intel Touch Host Controller (THC) hardware trigger the vulnerable path automatically during driver probe. An attacker with control over ACPI table contents, or one who can influence the driver's async initialization workqueue, can drive the kernel into a stack out-of-bounds write and crash the system.

The vulnerability manifests during ACPI resource parsing in the QuickI2C initialization path. No exploitation code was provided with this disclosure; refer to the upstream kernel commits for technical detail on the corrected memory layout.

Detection Methods for CVE-2025-39809

Indicators of Compromise

Kernel logs containing BUG: KASAN: stack-out-of-bounds in quicki2c_acpi_get_dsd_property on kernels with KASAN enabled.
Unexpected kernel panics or oops entries referencing quicki2c_get_acpi_resources or intel_quicki2c in the call trace.
System instability during boot or driver load on Intel THC-equipped hardware running 6.17-rc kernels.

Detection Strategies

Inventory hosts running Linux 6.17-rc1, 6.17-rc2, or 6.17-rc3 kernels and correlate with Intel Touch Host Controller hardware presence.
Enable KASAN in test and pre-production kernel builds to surface stack out-of-bounds writes originating from ACPI DSD parsing.
Search centralized log stores for kernel Oops signatures referencing the intel_quicki2c module.

Monitoring Recommendations

Forward dmesg and journald kernel messages to a centralized log platform and alert on KASAN or stack-out-of-bounds strings.
Monitor unexpected reboots and kernel crash dumps on endpoints running release-candidate kernels.
Track kernel package versions across the Linux fleet and flag hosts pinned to the affected 6.17-rc series.

How to Mitigate CVE-2025-39809

Immediate Actions Required

Update the Linux kernel to a build containing the upstream fix commits 1db9df89a213 and 4adce86d4b13.
Downgrade from 6.17-rc kernels to a stable release on production endpoints that do not require release-candidate features.
Restrict local access on multi-user systems with Intel THC hardware until the patched kernel is deployed.

Patch Information

The fix adds reserved padding to the quicki2c_subip_acpi_parameter and quicki2c_subip_acpi_config structs so their sizes match the ACPI _DSD buffer lengths. Patched builds are available through the upstream stable tree. Reference the Kernel Git Commit 1db9df89a213 and Kernel Git Commit 4adce86d4b13 for the exact source changes.

Workarounds

Blacklist the intel_quicki2c module on affected systems that do not require Intel Touch Host Controller functionality.
Boot with modprobe.blacklist=intel_quicki2c on the kernel command line until the patched kernel is installed.
Restrict physical and local shell access to affected hosts to reduce the risk of triggering the driver path.

bash

# Blacklist the vulnerable driver until a patched kernel is deployed
echo 'blacklist intel_quicki2c' | sudo tee /etc/modprobe.d/cve-2025-39809.conf
sudo update-initramfs -u

# Verify the module is not loaded after reboot
lsmod | grep intel_quicki2c