Junglewise Threat Intelligence

CVE-2025-39866: Linux Kernel use-after-free in __mark_inode_dirty

CVE-2025-39866 · Severity: high · CVSS 7.8 · Published 2025-09-19

Technologies: Linux Kernel, Siemens SIMATIC CN 4100, Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP. Vendors: Linux, Siemens.

Executive brief

A vulnerability was identified in the Linux kernel's file system writeback mechanism, which is responsible for saving data from memory to disk. A race condition can occur when the system attempts to mark a file as 'dirty' (modified) while simultaneously switching its internal tracking structures, leading to a system crash or potential unauthorized access. This affects various Linux-based systems, including industrial controllers like Siemens SIMATIC CPUs, potentially impacting operational stability and data integrity.

Technical details

A use-after-free (UAF) vulnerability exists in the Linux kernel's fs/fs-writeback.c component. The issue is rooted in a race condition between __mark_inode_dirty() and inode_switch_wbs_work_fn(). When an inode's writeback structure (bdi_writeback) is being switched, __mark_inode_dirty() may obtain a reference to the old structure. If the switching worker thread releases the old structure (via cgwb_release) before __mark_inode_dirty() calls wb_wakeup_delayed(), a UAF occurs. The fix involves extending the duration for which the inode spinlock is held to ensure the writeback structure remains valid until the wakeup call is completed. This is a local vulnerability requiring the ability to trigger file modifications.

Affected products

  • Linux Linux Kernel 6.6.56-gb4403bd46a8e and other stable branches
  • Siemens SIMATIC CN 4100 before V5.0
  • Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP V3.1.5 and later

Timeline

  • 2025-07-28: disclosed: Initial patch submission by Jiufei Xue
  • 2025-09-09: patched: Commits merged into stable kernel branches
  • 2025-09-19: advisory: CVE-2025-39866 published

References

Related threats