# CVE-2025-39796: linux: In the Linux kernel, the following vulnerability has been resolved:  net: lapbether: ignore ops-locked netdevs  Syzka...

CVE-2025-39796 is fixed in linux on 1 platform by DEBIAN-CVE-2025-39796 (version 6.16.3-1), released September 12, 2025. It is not reported as exploited. Patch Radar priority: High.

- Web page: https://patchblox.com/security/cve/CVE-2025-39796
- Priority: High
- CVSS: 7.8 (high)
- EPSS: 0.0015
- CISA KEV: not listed
- Exploited (vendor report): no
- Publicly disclosed: no
- Published: Sep 12, 2025

## Description

In the Linux kernel, the following vulnerability has been resolved:  net: lapbether: ignore ops-locked netdevs  Syzkaller managed to trigger lock dependency in xsk_notify via register_netdevice. As discussed in [0], using register_netdevice in the notifiers is problematic so skip adding lapbeth for ops-locked devices.         xsk_notifier+0xa4/0x280 net/xdp/xsk.c:1645        notifier_call_chain+0xbc/0x410 kernel/notifier.c:85        call_netdevice_notifiers_info+0xbe/0x140 net/core/dev.c:2230        call_netdevice_notifiers_extack net/core/dev.c:2268 [inline]        call_netdevice_notifiers net/core/dev.c:2282 [inline]        unregister_netdevice_many_notify+0xf9d/0x2700 net/core/dev.c:12077        unregister_netdevice_many net/core/dev.c:12140 [inline]        unregister_netdevice_queue+0x305/0x3f0 net/core/dev.c:11984        register_netdevice+0x18f1/0x2270 net/core/dev.c:11149        lapbeth_new_device drivers/net/wan/lapbether.c:420 [inline]        lapbeth_device_event+0x5b1/0xbe0 drivers/net/wan/lapbether.c:462        notifier_call_chain+0xbc/0x410 kernel/notifier.c:85        call_netdevice_notifiers_info+0xbe/0x140 net/core/dev.c:2230        call_netdevice_notifiers_extack net/core/dev.c:2268 [inline]        call_netdevice_notifiers net/core/dev.c:2282 [inline]        __dev_notify_flags+0x12c/0x2e0 net/core/dev.c:9497        netif_change_flags+0x108/0x160 net/core/dev.c:9526        dev_change_flags+0xba/0x250 net/core/dev_api.c:68        devinet_ioctl+0x11d5/0x1f50 net/ipv4/devinet.c:1200        inet_ioctl+0x3a7/0x3f0 net/ipv4/af_inet.c:1001  0: https://lore.kernel.org/netdev/20250625140357.6203d0af@kernel.org/

## Where it's fixed

| Platform | Product | Fixed in | Fix | Released |
|---|---|---|---|---|
| Linux | linux Debian 14 | 6.16.3-1 | [DEBIAN-CVE-2025-39796](https://patchblox.com/security/data/fix/linux/debian-cve-2025-39796.md) | Sep 12, 2025 |

---

Data as of 2026-11-08T13:06:02Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo

Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.