CVE-2025-39903

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

of_numa: fix uninitialized memory nodes causing kernel panic

When there are memory-only nodes (nodes without CPUs), these nodes are not

properly initialized, causing kernel panic during boot.

of_numa_init

of_numa_parse_cpu_nodes

node_set(nid, numa_nodes_parsed);

of_numa_parse_memory_nodes

In of_numa_parse_cpu_nodes, numa_nodes_parsed gets updated only for nodes

containing CPUs. Memory-only nodes should have been updated in

of_numa_parse_memory_nodes, but they weren't.

Subsequently, when free_area_init() attempts to access NODE_DATA() for

these uninitialized memory nodes, the kernel panics due to NULL pointer

dereference.

This can be reproduced on ARM64 QEMU with 1 CPU and 2 memory nodes:

qemu-system-aarch64 \

-cpu host -nographic \

-m 4G -smp 1 \

-machine virt,accel=kvm,gic-version=3,iommu=smmuv3 \

-object memory-backend-ram,size=2G,id=mem0 \

-object memory-backend-ram,size=2G,id=mem1 \

-numa node,nodeid=0,

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References