# CVE-2025-39809: linux: In the Linux kernel, the following vulnerability has been resolved:  HID: intel-thc-hid: intel-quicki2c: Fix ACPI dsd...

CVE-2025-39809 is fixed in linux on 1 platform by DEBIAN-CVE-2025-39809 (version 6.16.5-1), released September 16, 2025. It is not reported as exploited. Patch Radar priority: High.

- Web page: https://patchblox.com/security/cve/CVE-2025-39809
- Priority: High
- CVSS: 7.8 (high)
- EPSS: 0.0016
- CISA KEV: not listed
- Exploited (vendor report): no
- Publicly disclosed: no
- Published: Sep 16, 2025

## Description

In the Linux kernel, the following vulnerability has been resolved:  HID: intel-thc-hid: intel-quicki2c: Fix ACPI dsd ICRS/ISUB length  The QuickI2C ACPI _DSD methods return ICRS and ISUB data with a trailing byte, making the actual length is one more byte than the structs defined.  It caused stack-out-of-bounds and kernel crash:  kernel: BUG: KASAN: stack-out-of-bounds in quicki2c_acpi_get_dsd_property.constprop.0+0x111/0x1b0 [intel_quicki2c] kernel: Write of size 12 at addr ffff888106d1f900 by task kworker/u33:2/75 kernel: kernel: CPU: 3 UID: 0 PID: 75 Comm: kworker/u33:2 Not tainted 6.16.0+ #3 PREEMPT(voluntary) kernel: Workqueue: async async_run_entry_fn kernel: Call Trace: kernel:  <TASK> kernel:  dump_stack_lvl+0x76/0xa0 kernel:  print_report+0xd1/0x660 kernel:  ? __pfx__raw_spin_lock_irqsave+0x10/0x10 kernel:  ? __kasan_slab_free+0x5d/0x80 kernel:  ? kasan_addr_to_slab+0xd/0xb0 kernel:  kasan_report+0xe1/0x120 kernel:  ? quicki2c_acpi_get_dsd_property.constprop.0+0x111/0x1b0 [intel_quicki2c] kernel:  ? quicki2c_acpi_get_dsd_property.constprop.0+0x111/0x1b0 [intel_quicki2c] kernel:  kasan_check_range+0x11c/0x200 kernel:  __asan_memcpy+0x3b/0x80 kernel:  quicki2c_acpi_get_dsd_property.constprop.0+0x111/0x1b0 [intel_quicki2c] kernel:  ? __pfx_quicki2c_acpi_get_dsd_property.constprop.0+0x10/0x10 [intel_quicki2c] kernel:  quicki2c_get_acpi_resources+0x237/0x730 [intel_quicki2c] [...] kernel:  </TASK> kernel: kernel: The buggy address belongs to stack of task kworker/u33:2/75 kernel:  and is located at offset 48 in frame: kernel:  quicki2c_get_acpi_resources+0x0/0x730 [intel_quicki2c] kernel: kernel: This frame has 3 objects: kernel:  [32, 36) 'hid_desc_addr' kernel:  [48, 59) 'i2c_param' kernel:  [80, 224) 'i2c_config'  ACPI DSD methods return:  \_SB.PC00.THC0.ICRS Buffer       000000003fdc947b 001 Len 0C = 0A 00 80 1A 06 00 00 00 00 00 00 00 \_SB.PC00.THC0.ISUB Buffer       00000000f2fcbdc4 001 Len 91 = 00 00 00 00 00 00 00 00 00 00 00 00  Adding reserved padding to quicki2c_subip_acpi_parameter/config.

## Where it's fixed

| Platform | Product | Fixed in | Fix | Released |
|---|---|---|---|---|
| Linux | linux Debian 14 | 6.16.5-1 | [DEBIAN-CVE-2025-39809](https://patchblox.com/security/data/fix/linux/debian-cve-2025-39809.md) | Sep 16, 2025 |

---

Data as of 2026-11-08T06:59:42Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo

Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.