Junglewise Threat Intelligence

CVE-2025-39977: Linux Kernel use-after-free in futex requeue-PI

CVE-2025-39977 · Severity: info · CVSS 0 · Published 2025-10-15

Technologies: Linux Kernel, Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP. Vendors: Linux, Siemens.

Executive brief

A race condition in the Linux kernel's futex system—a mechanism used for process synchronization—could allow a local attacker to cause a system crash or potentially execute unauthorized code. The issue occurs when a process is being moved between wait queues and is interrupted by a signal or timeout, leading to a 'use-after-free' scenario where the system tries to access memory that has already been released. This primarily impacts system stability and availability.

Technical details

A use-after-free vulnerability exists in kernel/futex/requeue.c due to a race condition between futex_wait_requeue_pi() and futex_requeue(). When a task (T1) waiting on a requeue-PI operation is woken by a signal or timeout, it may exit and invalidate its stack-allocated futex_q structure before a second task (T2) completes the wake_up_state() call. The root cause is that futex_requeue_pi_complete() signals the locked state to the waiter before the waker has finished accessing the task structure. The fix involves using READ_ONCE to capture the task pointer before updating the requeue state, ensuring the task_struct remains valid during the subsequent wakeup call even if the original task terminates.

Affected products

  • Linux Linux Kernel Fixed in 6.1.113, 6.6.54, 6.10.13, 6.11.2, 6.12-rc1
  • Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP V3.1.5, V3.1.6

Timeline

  • 2025-09-10: patched: Initial fix authored by Sebastian Andrzej Siewior
  • 2025-10-15: disclosed: CVE published

References

Related threats