Executive brief
A vulnerability exists in the Linux kernel's Virtio User Mode Linux (UML) driver. This component is used to run Linux as a user-space process, often for testing or virtualization. An exploit could allow a local user to cause a system crash or potentially execute unauthorized code, impacting the stability and security of the virtualized environment.
Technical details
A use-after-free (UAF) vulnerability exists in arch/um/drivers/virtio_uml.c within the virtio_uml_probe function. The root cause is an incorrect error handling path: when register_virtio_device() fails, the code incorrectly sets the 'registered' flag to 1 and proceeds to call put_device(), leading to a UAF condition or inconsistent device state. This is a local vulnerability requiring low privileges. Attackers could potentially leverage this for local privilege escalation or to cause a kernel oops (denial of service). Patches have been released across multiple stable kernel branches including 5.10.y, 5.15.y, 6.1.y, 6.6.y, and 6.12.y.
Affected products
- Linux Linux Kernel 5.5 to 5.10.245, 5.11 to 5.15.194, 6.1.154, 6.6.108, 6.7 to 6.12.49
Timeline
- 2025-08-28: patched: Initial patch authored by Miaoqian Lin
- 2025-10-04: disclosed: CVE-2025-39951 published
References
- https://git.kernel.org/stable/c/00e98b5a69034b251bb36dc6e7123d7648e218e4
- https://git.kernel.org/stable/c/14c231959a16ca41bfdcaede72483362a8c645d7
- https://git.kernel.org/stable/c/4f364023ddcfe83f7073b973a9cb98584b7f2a46
- https://git.kernel.org/stable/c/5e94e44c9cb30d7a383d8ac227f24a8c9326b770
- https://git.kernel.org/stable/c/7ebf70cf181651fe3f2e44e95e7e5073d594c9c0
- https://git.kernel.org/stable/c/aaf900a83508c8cd5cdf765e7749f9076196ec7f
- https://git.kernel.org/stable/c/c2ff91255e0157b356cff115d8dc3eeb5162edf2