CVE-2025-39836

What it actually does

The setup_mm_hdr() function allocates a communication buffer via kmalloc() and passes it to tee_shm_register_kernel_buf(), which requires contiguous pages; the mismatch produces memory corruptions or kernel BUGs.

Why it matters to the business

Linux systems handling EFI STMM communications may suffer kernel instability, crashes, or memory corruption that disrupts operations and increases security risk until kernels are updated.

How an attack unfolds

An attacker triggers the affected EFI STMM path so that the incorrectly allocated buffer is registered with the TEE shared-memory interface, resulting in corruption that may be leveraged for denial of service or further memory-safety violations.

How to fix it

Upgrade the Linux kernel to the commit 77ff27ff0e4529a003c8a1c2492c111968c378d3 or later; rebuild and reboot with the corrected alloc_pages_exact() allocation in setup_mm_hdr().

How to confirm the fix worked

Verify the kernel source contains alloc_pages_exact() in setup_mm_hdr(), confirm the running kernel reports the fixed commit, and test that tee_shm_register_kernel_buf() receives contiguous pages.

Typical attack path

1. Obtain local or remote access that can invoke EFI STMM communication routines
2. Force execution of setup_mm_hdr() to allocate the buffer with kmalloc()
3. Pass the buffer to tee_shm_register_kernel_buf() to trigger the page-contiguity violation
4. Exploit resulting memory corruption for denial of service or privilege escalation

How to detect it

Review kernel logs for BUG, oops, or slab corruption messages originating from EFI STMM or TEE shared-memory registration paths; correlate with processes that invoke tee_shm_register_kernel_buf().

What your security team should do

• Prioritize kernel upgrades on all systems that use EFI STMM and TEE shared-memory interfaces
• Apply the fix from commit 77ff27ff0e4529a003c8a1c2492c111968c378d3 and schedule staged rollouts
• Monitor kernel logs for slab or memory-allocation BUGs related to EFI/TEE paths until remediation is complete