CVE-2025-39787

A flaw was found in the Linux kernel's soc: qcom: mdt_loader component. This vulnerability allows a local attacker to cause a Denial of Service (DoS) by providing a specially crafted firmware buffer. The flaw occurs because the MDT loader does not sufficiently validate the size of the ELF header and its section entry sizes (e_phentsize and e_shentsize), leading to a read past the end of the buffer.

A moderate-severity flaw was found in the Linux kernel's Qualcomm MDT firmware loader (soc: qcom: mdt_loader). The MDT loader did not validate the size of the firmware buffer, nor the e_phentsize and e_shentsize ELF header fields, before iterating over the ELF header, so processing a specially crafted firmware buffer could cause the kernel to read past the end of that buffer. A local attacker able to supply a crafted Qualcomm MDT firmware image and trigger its loading could use this flaw to cause a denial of service, such as a kernel crash. When the MDT loader is used via remoteproc the ELF header is sanitized beforehand, but that is not necessarily the case for other clients of the loader. Red Hat Enterprise Linux 10 and Red Hat In-Vehicle OS 1 are affected; the fix for these streams is currently deferred, and the residual risk is that a local attacker with the high privileges needed to load a crafted firmware image could crash the system (denial of service only). Red Hat Enterprise Linux 6, 7, 8, and 9 are not affected because the vulnerable code is not present in those releases. Red Hat rates this flaw Moderate (CVSS 6.0), lower than the CVE.org rating of Important (7.8), primarily because Red Hat assesses that exploitation requires high privileges and that the practical impact is limited to availability.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.