In the Linux kernel, the following vulnerability has been resolved:
soc: qcom: mdt_loader: Ensure we don't read past the ELF header
When the MDT loader is used in remoteproc, the ELF header is sanitized beforehand, but that's not necessary the case for other clients.
Validate the size of the firmware buffer to ensure that we don't read past the end as we iterate over the header. ephentsize and eshentsize are validated as well, to ensure that the assumptions about step size in the traversal are valid.
[
{
"signature_type": "Function",
"digest": {
"function_hash": "317960929462186046322556162064345341395",
"length": 534.0
},
"target": {
"file": "drivers/soc/qcom/mdt_loader.c",
"function": "qcom_mdt_get_size"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1096eb63ecfc8df90b70cd068e6de0c2ff204dfd",
"id": "CVE-2025-39787-02169c54",
"deprecated": false,
"signature_version": "v1"
},
{
"signature_type": "Function",
"digest": {
"function_hash": "233494279503162896868594956708515141344",
"length": 1336.0
},
"target": {
"file": "drivers/soc/qcom/mdt_loader.c",
"function": "qcom_mdt_read_metadata"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@81278be4eb5f08ba2c68c3055893e61cc03727fe",
"id": "CVE-2025-39787-292f5b1d",
"deprecated": false,
"signature_version": "v1"
},
{
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"51610076624880992513230029810324489194",
"117151995092954085727604614157979921670",
"260913058910345682859035577984587246645",
"292526461622119944778958882720908346601",
"65858578964479747869865045629897721066",
"63725777545963102062469516654427227082",
"167957328755850256117676719436498103550",
"180082321456827329759608880354323261106",
"149242992777141146283591972133420228414",
"1099273595066184558981898314967674656",
"235001170292032791114499344006079985078",
"63725777545963102062469516654427227082",
"108860177893171755930081638869798921282",
"101312419193859648626724183885701390926",
"57399224931745648553460595531209118655"
]
},
"target": {
"file": "drivers/soc/qcom/mdt_loader.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@81278be4eb5f08ba2c68c3055893e61cc03727fe",
"id": "CVE-2025-39787-2ea0a5e3",
"deprecated": false,
"signature_version": "v1"
},
{
"signature_type": "Function",
"digest": {
"function_hash": "307019036010663374162505273741121712687",
"length": 815.0
},
"target": {
"file": "drivers/soc/qcom/mdt_loader.c",
"function": "qcom_mdt_read_metadata"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0d59ce2bfc3bb13abe6240335a1bf7b96536d022",
"id": "CVE-2025-39787-36b91972",
"deprecated": false,
"signature_version": "v1"
},
{
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"184321209056059697214632106270601185898",
"188090330883537691580222972626405742005",
"181168298841825135577602886923699846867",
"121624271721600006852663907380978241301",
"120622034831902962978756269230393092258",
"51610076624880992513230029810324489194",
"117151995092954085727604614157979921670",
"260913058910345682859035577984587246645",
"292526461622119944778958882720908346601",
"122290258023932720488735796809770926801",
"155648230496362922529539985483997132331",
"7996142987433905980967893057253015869",
"153710130048954835715764906847502778610",
"122934971262648376370529863213347694894",
"22479787671835043356130310069626093978",
"197474235353820087971452823411685131330",
"121669617959298745239643597667730976856"
]
},
"target": {
"file": "drivers/soc/qcom/mdt_loader.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1096eb63ecfc8df90b70cd068e6de0c2ff204dfd",
"id": "CVE-2025-39787-37fe2e9c",
"deprecated": false,
"signature_version": "v1"
},
{
"signature_type": "Function",
"digest": {
"function_hash": "310030596887398885911061970458676584767",
"length": 1778.0
},
"target": {
"file": "drivers/soc/qcom/mdt_loader.c",
"function": "__qcom_mdt_load"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9f9967fed9d066ed3dae9372b45ffa4f6fccfeef",
"id": "CVE-2025-39787-4000552c",
"deprecated": false,
"signature_version": "v1"
},
{
"signature_type": "Function",
"digest": {
"function_hash": "7325591348583773276571583305103790481",
"length": 2821.0
},
"target": {
"file": "drivers/soc/qcom/mdt_loader.c",
"function": "__qcom_mdt_load"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e1720eb32acf411c328af6a8c8f556c94535808e",
"id": "CVE-2025-39787-405fcee1",
"deprecated": false,
"signature_version": "v1"
},
{
"signature_type": "Function",
"digest": {
"function_hash": "233494279503162896868594956708515141344",
"length": 1336.0
},
"target": {
"file": "drivers/soc/qcom/mdt_loader.c",
"function": "qcom_mdt_read_metadata"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@981c845f29838e468a9bfa87f784307193a31297",
"id": "CVE-2025-39787-4067a17d",
"deprecated": false,
"signature_version": "v1"
},
{
"signature_type": "Function",
"digest": {
"function_hash": "45918933504348574703118012791827906105",
"length": 557.0
},
"target": {
"file": "drivers/soc/qcom/mdt_loader.c",
"function": "qcom_mdt_get_size"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@981c845f29838e468a9bfa87f784307193a31297",
"id": "CVE-2025-39787-407636ba",
"deprecated": false,
"signature_version": "v1"
},
{
"signature_type": "Function",
"digest": {
"function_hash": "317960929462186046322556162064345341395",
"length": 534.0
},
"target": {
"file": "drivers/soc/qcom/mdt_loader.c",
"function": "qcom_mdt_get_size"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e1720eb32acf411c328af6a8c8f556c94535808e",
"id": "CVE-2025-39787-5c997232",
"deprecated": false,
"signature_version": "v1"
},
{
"signature_type": "Function",
"digest": {
"function_hash": "166544047420415554783249091445715548950",
"length": 1801.0
},
"target": {
"file": "drivers/soc/qcom/mdt_loader.c",
"function": "__qcom_mdt_load"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@981c845f29838e468a9bfa87f784307193a31297",
"id": "CVE-2025-39787-5e94491f",
"deprecated": false,
"signature_version": "v1"
},
{
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"51610076624880992513230029810324489194",
"117151995092954085727604614157979921670",
"260913058910345682859035577984587246645",
"292526461622119944778958882720908346601",
"122290258023932720488735796809770926801",
"155648230496362922529539985483997132331",
"167957328755850256117676719436498103550",
"182983552908851330461867457615885871993",
"122934971262648376370529863213347694894",
"1099273595066184558981898314967674656",
"319875656582612750695236177747652391970",
"155648230496362922529539985483997132331",
"108860177893171755930081638869798921282",
"101312419193859648626724183885701390926",
"15365246607761143356529649943767350178"
]
},
"target": {
"file": "drivers/soc/qcom/mdt_loader.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9f9967fed9d066ed3dae9372b45ffa4f6fccfeef",
"id": "CVE-2025-39787-659662e2",
"deprecated": false,
"signature_version": "v1"
},
{
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"184321209056059697214632106270601185898",
"188090330883537691580222972626405742005",
"181168298841825135577602886923699846867",
"121624271721600006852663907380978241301",
"120622034831902962978756269230393092258",
"51610076624880992513230029810324489194",
"117151995092954085727604614157979921670",
"260913058910345682859035577984587246645",
"292526461622119944778958882720908346601",
"122290258023932720488735796809770926801",
"155648230496362922529539985483997132331",
"7996142987433905980967893057253015869",
"153710130048954835715764906847502778610",
"122934971262648376370529863213347694894",
"22479787671835043356130310069626093978",
"197474235353820087971452823411685131330",
"121669617959298745239643597667730976856"
]
},
"target": {
"file": "drivers/soc/qcom/mdt_loader.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e1720eb32acf411c328af6a8c8f556c94535808e",
"id": "CVE-2025-39787-6786ad96",
"deprecated": false,
"signature_version": "v1"
},
{
"signature_type": "Function",
"digest": {
"function_hash": "317960929462186046322556162064345341395",
"length": 534.0
},
"target": {
"file": "drivers/soc/qcom/mdt_loader.c",
"function": "qcom_mdt_get_size"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0d59ce2bfc3bb13abe6240335a1bf7b96536d022",
"id": "CVE-2025-39787-6817561c",
"deprecated": false,
"signature_version": "v1"
},
{
"signature_type": "Function",
"digest": {
"function_hash": "173135788601194330610383833482631812065",
"length": 1254.0
},
"target": {
"file": "drivers/soc/qcom/mdt_loader.c",
"function": "qcom_mdt_pas_init"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@981c845f29838e468a9bfa87f784307193a31297",
"id": "CVE-2025-39787-76e771f5",
"deprecated": false,
"signature_version": "v1"
},
{
"signature_type": "Function",
"digest": {
"function_hash": "45131393582053100128159380076931082065",
"length": 2930.0
},
"target": {
"file": "drivers/soc/qcom/mdt_loader.c",
"function": "__qcom_mdt_load"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0d59ce2bfc3bb13abe6240335a1bf7b96536d022",
"id": "CVE-2025-39787-92a1f8b2",
"deprecated": false,
"signature_version": "v1"
},
{
"signature_type": "Function",
"digest": {
"function_hash": "166544047420415554783249091445715548950",
"length": 1801.0
},
"target": {
"file": "drivers/soc/qcom/mdt_loader.c",
"function": "__qcom_mdt_load"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@81278be4eb5f08ba2c68c3055893e61cc03727fe",
"id": "CVE-2025-39787-9349782c",
"deprecated": false,
"signature_version": "v1"
},
{
"signature_type": "Function",
"digest": {
"function_hash": "307019036010663374162505273741121712687",
"length": 815.0
},
"target": {
"file": "drivers/soc/qcom/mdt_loader.c",
"function": "qcom_mdt_read_metadata"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e1720eb32acf411c328af6a8c8f556c94535808e",
"id": "CVE-2025-39787-9f342046",
"deprecated": false,
"signature_version": "v1"
},
{
"signature_type": "Function",
"digest": {
"function_hash": "52944921478916779237250283236805768002",
"length": 1314.0
},
"target": {
"file": "drivers/soc/qcom/mdt_loader.c",
"function": "qcom_mdt_read_metadata"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9f9967fed9d066ed3dae9372b45ffa4f6fccfeef",
"id": "CVE-2025-39787-aad4f044",
"deprecated": false,
"signature_version": "v1"
},
{
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"51610076624880992513230029810324489194",
"117151995092954085727604614157979921670",
"260913058910345682859035577984587246645",
"292526461622119944778958882720908346601",
"65858578964479747869865045629897721066",
"63725777545963102062469516654427227082",
"167957328755850256117676719436498103550",
"180082321456827329759608880354323261106",
"149242992777141146283591972133420228414",
"1099273595066184558981898314967674656",
"235001170292032791114499344006079985078",
"63725777545963102062469516654427227082",
"108860177893171755930081638869798921282",
"101312419193859648626724183885701390926",
"57399224931745648553460595531209118655"
]
},
"target": {
"file": "drivers/soc/qcom/mdt_loader.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@981c845f29838e468a9bfa87f784307193a31297",
"id": "CVE-2025-39787-ad4ee331",
"deprecated": false,
"signature_version": "v1"
},
{
"signature_type": "Function",
"digest": {
"function_hash": "317960929462186046322556162064345341395",
"length": 534.0
},
"target": {
"file": "drivers/soc/qcom/mdt_loader.c",
"function": "qcom_mdt_get_size"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9f9967fed9d066ed3dae9372b45ffa4f6fccfeef",
"id": "CVE-2025-39787-ae6d5e58",
"deprecated": false,
"signature_version": "v1"
},
{
"signature_type": "Function",
"digest": {
"function_hash": "307019036010663374162505273741121712687",
"length": 815.0
},
"target": {
"file": "drivers/soc/qcom/mdt_loader.c",
"function": "qcom_mdt_read_metadata"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1096eb63ecfc8df90b70cd068e6de0c2ff204dfd",
"id": "CVE-2025-39787-d4c86eb3",
"deprecated": false,
"signature_version": "v1"
},
{
"signature_type": "Function",
"digest": {
"function_hash": "44953528548959552730524211862943450122",
"length": 1231.0
},
"target": {
"file": "drivers/soc/qcom/mdt_loader.c",
"function": "qcom_mdt_pas_init"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9f9967fed9d066ed3dae9372b45ffa4f6fccfeef",
"id": "CVE-2025-39787-d5149883",
"deprecated": false,
"signature_version": "v1"
},
{
"signature_type": "Function",
"digest": {
"function_hash": "7325591348583773276571583305103790481",
"length": 2821.0
},
"target": {
"file": "drivers/soc/qcom/mdt_loader.c",
"function": "__qcom_mdt_load"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1096eb63ecfc8df90b70cd068e6de0c2ff204dfd",
"id": "CVE-2025-39787-e7b30c76",
"deprecated": false,
"signature_version": "v1"
},
{
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"184321209056059697214632106270601185898",
"188090330883537691580222972626405742005",
"181168298841825135577602886923699846867",
"121624271721600006852663907380978241301",
"120622034831902962978756269230393092258",
"51610076624880992513230029810324489194",
"117151995092954085727604614157979921670",
"260913058910345682859035577984587246645",
"292526461622119944778958882720908346601",
"122290258023932720488735796809770926801",
"155648230496362922529539985483997132331",
"7996142987433905980967893057253015869",
"153710130048954835715764906847502778610",
"122934971262648376370529863213347694894",
"22479787671835043356130310069626093978",
"197474235353820087971452823411685131330",
"121669617959298745239643597667730976856"
]
},
"target": {
"file": "drivers/soc/qcom/mdt_loader.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0d59ce2bfc3bb13abe6240335a1bf7b96536d022",
"id": "CVE-2025-39787-ea776f08",
"deprecated": false,
"signature_version": "v1"
},
{
"signature_type": "Function",
"digest": {
"function_hash": "45918933504348574703118012791827906105",
"length": 557.0
},
"target": {
"file": "drivers/soc/qcom/mdt_loader.c",
"function": "qcom_mdt_get_size"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@81278be4eb5f08ba2c68c3055893e61cc03727fe",
"id": "CVE-2025-39787-f9e29b0e",
"deprecated": false,
"signature_version": "v1"
},
{
"signature_type": "Function",
"digest": {
"function_hash": "173135788601194330610383833482631812065",
"length": 1254.0
},
"target": {
"file": "drivers/soc/qcom/mdt_loader.c",
"function": "qcom_mdt_pas_init"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@81278be4eb5f08ba2c68c3055893e61cc03727fe",
"id": "CVE-2025-39787-fc879413",
"deprecated": false,
"signature_version": "v1"
}
]