Junglewise Threat Intelligence

CVE-2025-39881: Linux Kernel use-after-free in kernfs polling

CVE-2025-39881 · Severity: high · CVSS 7.8 · Published 2025-09-23

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

A security vulnerability has been identified in the Linux kernel's Pressure Stall Information (PSI) monitoring system, which tracks system resource pressure. A local attacker could exploit a race condition to cause a system crash or potentially execute unauthorized code by manipulating how these monitoring files are opened and closed. This issue primarily affects system stability and could be used to gain deeper access to the underlying operating system.

Technical details

A use-after-free (UAF) vulnerability exists in the kernfs subsystem of the Linux kernel. The root cause is a race condition between epoll monitoring and the release of PSI (Pressure Stall Information) triggers. When a cgroup pressure file is disabled, the kernel releases PSI triggers and frees the associated private data (of->priv). However, if an epoll instance still holds a reference to the file and continues polling, re-enabling the monitoring can lead to an access of the previously freed memory in psi_trigger_poll. An attacker with local access can trigger this by rapidly toggling cgroup pressure monitoring while polling the file descriptor. The fix introduces kernfs_get_active_of() to ensure active references are valid and have not been released before proceeding with polling operations.

Affected products

  • Linux Linux Kernel 6.1 to 6.1.153, 6.6 to 6.6.107, 6.12 to 6.12.48

Timeline

  • 2025-08-22: disclosed: Initial patch submitted by Huawei developers
  • 2025-09-06: patched: Patch committed to stable kernel tree
  • 2025-09-23: advisory: CVE-2025-39881 published

References

Related threats