# CVE-2025-39866: Linux Kernel use-after-free in __mark_inode_dirty

Source: https://junglewise.ai/threats/cve-2025-39866-linux-kernel-use-after-free-in-mark-inode-dirty  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2025-09-19. Updated: 2026-07-14  
License: CC BY 4.0 with a link back

CVE-2025-39866 · Severity: high · CVSS 7.8 · Published 2025-09-19

A vulnerability was identified in the Linux kernel's file system writeback mechanism, which is responsible for saving data from memory to disk. A race condition can occur when the system attempts to mark a file as 'dirty' (modified) while simultaneously switching its internal tracking structures, leading to a system crash or potential unauthorized access. This affects various Linux-based systems, including industrial controllers like Siemens SIMATIC CPUs, potentially impacting operational stability and data integrity.

Technologies: [Linux Kernel](https://junglewise.ai/threats/technologies/kernel), [Siemens SIMATIC CN 4100](https://junglewise.ai/threats/technologies/simatic-cn-4100), [Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP](https://junglewise.ai/threats/technologies/simatic-s7-1500-cpu-1518-4-pn-dp-mfp). Vendors: [Linux](https://junglewise.ai/threats/vendors/linux), [Siemens](https://junglewise.ai/threats/vendors/siemens).

## Quick answers

**Is CVE-2025-39866 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-39866 being exploited in the wild.

**How severe is CVE-2025-39866?** High severity, with a CVSS score of 7.8, published 19 September 2025.

**Which products and versions are affected?** Linux Kernel 4.2 to 5.10.247, 5.11 to 5.15.192, 5.16 to 6.1.151, 6.2 to 6.6.105, 6.7 to 6.12.46, 6.13 to 6.16.6, 6.6.56-gb4403bd46a8e and other stable branches; Siemens SIMATIC CN 4100 before V5.0; Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP V3.1.5 and later.

**Is there a fix for CVE-2025-39866?** A patch was published on 2025-09-09: Commits merged into stable kernel branches Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2025-39866 attacked?** It is attacked with local access, in an operating system.

**Am I affected by CVE-2025-39866?** Check whether you run Linux Kernel, Siemens SIMATIC CN 4100 or Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A use-after-free (UAF) vulnerability exists in the Linux kernel's fs/fs-writeback.c component. The issue is rooted in a race condition between __mark_inode_dirty() and inode_switch_wbs_work_fn(). When an inode's writeback structure (bdi_writeback) is being switched, __mark_inode_dirty() may obtain a reference to the old structure. If the switching worker thread releases the old structure (via cgwb_release) before __mark_inode_dirty() calls wb_wakeup_delayed(), a UAF occurs. The fix involves extending the duration for which the inode spinlock is held to ensure the writeback structure remains valid until the wakeup call is completed. This is a local vulnerability requiring the ability to trigger file modifications.

## Affected products

- Linux Linux Kernel 6.6.56-gb4403bd46a8e and other stable branches
- Siemens SIMATIC CN 4100 before V5.0
- Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP V3.1.5 and later

## Timeline

- 2025-07-28: disclosed: Initial patch submission by Jiufei Xue
- 2025-09-09: patched: Commits merged into stable kernel branches
- 2025-09-19: advisory: CVE-2025-39866 published

## References

- [https://git.kernel.org/stable/c/1edc2feb9c759a9883dfe81cb5ed231412d8b2e4](https://git.kernel.org/stable/c/1edc2feb9c759a9883dfe81cb5ed231412d8b2e4)
- [https://git.kernel.org/stable/c/b187c976111960e6e54a6b1fff724f6e3d39406c](https://git.kernel.org/stable/c/b187c976111960e6e54a6b1fff724f6e3d39406c)
- [https://git.kernel.org/stable/c/bf89b1f87c72df79cf76203f71fbf8349cd5c9de](https://git.kernel.org/stable/c/bf89b1f87c72df79cf76203f71fbf8349cd5c9de)
- [https://git.kernel.org/stable/c/c8c14adf80bd1a6e4a1d7ee9c2a816881c26d17a](https://git.kernel.org/stable/c/c8c14adf80bd1a6e4a1d7ee9c2a816881c26d17a)
- [https://git.kernel.org/stable/c/d02d2c98d25793902f65803ab853b592c7a96b29](https://git.kernel.org/stable/c/d02d2c98d25793902f65803ab853b592c7a96b29)
- [https://git.kernel.org/stable/c/e2a14bbae5d8bacaa301362744a110e2be40a3a3](https://git.kernel.org/stable/c/e2a14bbae5d8bacaa301362744a110e2be40a3a3)
- [https://git.kernel.org/stable/c/e63052921f1b25a836feb1500b841bff7a4a0456](https://git.kernel.org/stable/c/e63052921f1b25a836feb1500b841bff7a4a0456)

## Related threats

- [Linux IOMMU page table logic error in arm_lpae_split_blk_unmap](https://junglewise.ai/threats/cve-2026-56934-in-arm-lpae-split-blk-unmap-of-drivers-iommu-io-pgtable-arm)
- [Linux kernel null pointer dereference in TCP established lookup](https://junglewise.ai/threats/cve-2026-99288-in-the-linux-kernel-the-following-vulnerability-has-been-resolved)
- [Linux kernel xen-netback race condition in XenBus disconnect](https://junglewise.ai/threats/cve-2026-99286-in-the-linux-kernel-the-following-vulnerability-has-been-resolved)
- [Linux kernel shared-frag flag loss in skb_zerocopy](https://junglewise.ai/threats/cve-2026-99284-in-the-linux-kernel-the-following-vulnerability-has-been-resolved)
- [Linux kernel netfilter conntrack TCP RST timeout handling](https://junglewise.ai/threats/cve-2026-99283-in-the-linux-kernel-the-following-vulnerability-has-been-resolved)