{
  "cveId": "CVE-2025-39796",
  "url": "https://patchblox.com/security/cve/CVE-2025-39796",
  "summary": "CVE-2025-39796 is fixed in linux on 1 platform by DEBIAN-CVE-2025-39796 (version 6.16.3-1), released September 12, 2025. It is not reported as exploited. Patch Radar priority: High.",
  "title": "linux: In the Linux kernel, the following vulnerability has been resolved:  net: lapbether: ignore ops-locked netdevs  Syzka...",
  "description": "In the Linux kernel, the following vulnerability has been resolved:  net: lapbether: ignore ops-locked netdevs  Syzkaller managed to trigger lock dependency in xsk_notify via register_netdevice. As discussed in [0], using register_netdevice in the notifiers is problematic so skip adding lapbeth for ops-locked devices.         xsk_notifier\u002B0xa4/0x280 net/xdp/xsk.c:1645        notifier_call_chain\u002B0xbc/0x410 kernel/notifier.c:85        call_netdevice_notifiers_info\u002B0xbe/0x140 net/core/dev.c:2230        call_netdevice_notifiers_extack net/core/dev.c:2268 [inline]        call_netdevice_notifiers net/core/dev.c:2282 [inline]        unregister_netdevice_many_notify\u002B0xf9d/0x2700 net/core/dev.c:12077        unregister_netdevice_many net/core/dev.c:12140 [inline]        unregister_netdevice_queue\u002B0x305/0x3f0 net/core/dev.c:11984        register_netdevice\u002B0x18f1/0x2270 net/core/dev.c:11149        lapbeth_new_device drivers/net/wan/lapbether.c:420 [inline]        lapbeth_device_event\u002B0x5b1/0xbe0 drivers/net/wan/lapbether.c:462        notifier_call_chain\u002B0xbc/0x410 kernel/notifier.c:85        call_netdevice_notifiers_info\u002B0xbe/0x140 net/core/dev.c:2230        call_netdevice_notifiers_extack net/core/dev.c:2268 [inline]        call_netdevice_notifiers net/core/dev.c:2282 [inline]        __dev_notify_flags\u002B0x12c/0x2e0 net/core/dev.c:9497        netif_change_flags\u002B0x108/0x160 net/core/dev.c:9526        dev_change_flags\u002B0xba/0x250 net/core/dev_api.c:68        devinet_ioctl\u002B0x11d5/0x1f50 net/ipv4/devinet.c:1200        inet_ioctl\u002B0x3a7/0x3f0 net/ipv4/af_inet.c:1001  0: https://lore.kernel.org/netdev/20250625140357.6203d0af@kernel.org/",
  "published": "2025-09-12T16:15:33Z",
  "severity": "high",
  "cvss": 7.8,
  "cvssVector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
  "epss": 0.00154,
  "epssPercentile": 0.04589,
  "priority": "High",
  "priorityTier": 3,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 14",
      "fixedVersion": "6.16.3-1",
      "fix": "DEBIAN-CVE-2025-39796",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2025-39796",
      "released": "2025-09-12T16:15:33Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-08T13:06:02Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}