CVE-2025-39866: Linux Kernel use-after-free in __mark_inode_dirty

CVE-2025-39866 · Severity: high · CVSS 7.8 · Published 2025-09-19

A vulnerability was identified in the Linux kernel's file system writeback mechanism, which is responsible for saving data from memory to disk. A race condition can occur when the system attempts to mark a file as 'dirty' (modified) while simultaneously switching its internal tracking structures, leading to a system crash or potential unauthorized access. This affects various Linux-based systems, including industrial controllers like Siemens SIMATIC CPUs, potentially impacting operational stability and data integrity.

Technologies: Linux Kernel, Siemens SIMATIC CN 4100, Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP. Vendors: Linux, Siemens.

Quick answers

Is CVE-2025-39866 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2025-39866 being exploited in the wild.
How severe is CVE-2025-39866?
High severity, with a CVSS score of 7.8, published 19 September 2025.
Which products and versions are affected?
Linux Kernel 4.2 to 5.10.247, 5.11 to 5.15.192, 5.16 to 6.1.151, 6.2 to 6.6.105, 6.7 to 6.12.46, 6.13 to 6.16.6, 6.6.56-gb4403bd46a8e and other stable branches; Siemens SIMATIC CN 4100 before V5.0; Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP V3.1.5 and later.
Is there a fix for CVE-2025-39866?
A patch was published on 2025-09-09: Commits merged into stable kernel branches Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2025-39866 attacked?
It is attacked with local access, in an operating system.
Am I affected by CVE-2025-39866?
Check whether you run Linux Kernel, Siemens SIMATIC CN 4100 or Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A use-after-free (UAF) vulnerability exists in the Linux kernel's fs/fs-writeback.c component. The issue is rooted in a race condition between __mark_inode_dirty() and inode_switch_wbs_work_fn(). When an inode's writeback structure (bdi_writeback) is being switched, __mark_inode_dirty() may obtain a reference to the old structure. If the switching worker thread releases the old structure (via cgwb_release) before __mark_inode_dirty() calls wb_wakeup_delayed(), a UAF occurs. The fix involves extending the duration for which the inode spinlock is held to ensure the writeback structure remains valid until the wakeup call is completed. This is a local vulnerability requiring the ability to trigger file modifications.

Affected products

  • Linux Linux Kernel 6.6.56-gb4403bd46a8e and other stable branches
  • Siemens SIMATIC CN 4100 before V5.0
  • Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP V3.1.5 and later

Timeline

  • 2025-07-28: disclosed: Initial patch submission by Jiufei Xue
  • 2025-09-09: patched: Commits merged into stable kernel branches
  • 2025-09-19: advisory: CVE-2025-39866 published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.