{
  "affected": [
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:14",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.16.3-1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "details": "In the Linux kernel, the following vulnerability has been resolved:  net: lapbether: ignore ops-locked netdevs  Syzkaller managed to trigger lock dependency in xsk_notify via register_netdevice. As discussed in [0], using register_netdevice in the notifiers is problematic so skip adding lapbeth for ops-locked devices.         xsk_notifier+0xa4/0x280 net/xdp/xsk.c:1645        notifier_call_chain+0xbc/0x410 kernel/notifier.c:85        call_netdevice_notifiers_info+0xbe/0x140 net/core/dev.c:2230        call_netdevice_notifiers_extack net/core/dev.c:2268 [inline]        call_netdevice_notifiers net/core/dev.c:2282 [inline]        unregister_netdevice_many_notify+0xf9d/0x2700 net/core/dev.c:12077        unregister_netdevice_many net/core/dev.c:12140 [inline]        unregister_netdevice_queue+0x305/0x3f0 net/core/dev.c:11984        register_netdevice+0x18f1/0x2270 net/core/dev.c:11149        lapbeth_new_device drivers/net/wan/lapbether.c:420 [inline]        lapbeth_device_event+0x5b1/0xbe0 drivers/net/wan/lapbether.c:462        notifier_call_chain+0xbc/0x410 kernel/notifier.c:85        call_netdevice_notifiers_info+0xbe/0x140 net/core/dev.c:2230        call_netdevice_notifiers_extack net/core/dev.c:2268 [inline]        call_netdevice_notifiers net/core/dev.c:2282 [inline]        __dev_notify_flags+0x12c/0x2e0 net/core/dev.c:9497        netif_change_flags+0x108/0x160 net/core/dev.c:9526        dev_change_flags+0xba/0x250 net/core/dev_api.c:68        devinet_ioctl+0x11d5/0x1f50 net/ipv4/devinet.c:1200        inet_ioctl+0x3a7/0x3f0 net/ipv4/af_inet.c:1001  0: https://lore.kernel.org/netdev/20250625140357.6203d0af@kernel.org/",
  "id": "DEBIAN-CVE-2025-39796",
  "modified": "2026-09-01T19:48:16.803762344Z",
  "published": "2025-09-12T16:15:33.987Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://security-tracker.debian.org/tracker/CVE-2025-39796"
    }
  ],
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "upstream": [
    "CVE-2025-39796"
  ]
}