GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2025-39881 (GCVE-0-2025-39881)

Vulnerability from cvelistv5 – Published: 2025-09-23 06:00 – Updated: 2026-08-05 12:05
VLAI
Title
kernfs: Fix UAF in polling when open file is released
Summary
In the Linux kernel, the following vulnerability has been resolved: kernfs: Fix UAF in polling when open file is released A use-after-free (UAF) vulnerability was identified in the PSI (Pressure Stall Information) monitoring mechanism: BUG: KASAN: slab-use-after-free in psi_trigger_poll+0x3c/0x140 Read of size 8 at addr ffff3de3d50bd308 by task systemd/1 psi_trigger_poll+0x3c/0x140 cgroup_pressure_poll+0x70/0xa0 cgroup_file_poll+0x8c/0x100 kernfs_fop_poll+0x11c/0x1c0 ep_item_poll.isra.0+0x188/0x2c0 Allocated by task 1: cgroup_file_open+0x88/0x388 kernfs_fop_open+0x73c/0xaf0 do_dentry_open+0x5fc/0x1200 vfs_open+0xa0/0x3f0 do_open+0x7e8/0xd08 path_openat+0x2fc/0x6b0 do_filp_open+0x174/0x368 Freed by task 8462: cgroup_file_release+0x130/0x1f8 kernfs_drain_open_files+0x17c/0x440 kernfs_drain+0x2dc/0x360 kernfs_show+0x1b8/0x288 cgroup_file_show+0x150/0x268 cgroup_pressure_write+0x1dc/0x340 cgroup_file_write+0x274/0x548 Reproduction Steps: 1. Open test/cpu.pressure and establish epoll monitoring 2. Disable monitoring: echo 0 > test/cgroup.pressure 3. Re-enable monitoring: echo 1 > test/cgroup.pressure The race condition occurs because: 1. When cgroup.pressure is disabled (echo 0 > cgroup.pressure), it: - Releases PSI triggers via cgroup_file_release() - Frees of->priv through kernfs_drain_open_files() 2. While epoll still holds reference to the file and continues polling 3. Re-enabling (echo 1 > cgroup.pressure) accesses freed of->priv epolling disable/enable cgroup.pressure fd=open(cpu.pressure) while(1) ... epoll_wait kernfs_fop_poll kernfs_get_active = true echo 0 > cgroup.pressure ... cgroup_file_show kernfs_show // inactive kn kernfs_drain_open_files cft->release(of); kfree(ctx); ... kernfs_get_active = false echo 1 > cgroup.pressure kernfs_show kernfs_activate_one(kn); kernfs_fop_poll kernfs_get_active = true cgroup_file_poll psi_trigger_poll // UAF ... end: close(fd) To address this issue, introduce kernfs_get_active_of() for kernfs open files to obtain active references. This function will fail if the open file has been released. Replace kernfs_get_active() with kernfs_get_active_of() to prevent further operations on released file descriptors.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 34f26a15611afb03c33df6819359d36f5b382589 , < 34d9cafd469c69ad85e6a36b4303c78382cf5c79 (git)
Affected: 34f26a15611afb03c33df6819359d36f5b382589 , < 854baafc00c433cccbe0ab4231b77aeb9b637b77 (git)
Affected: 34f26a15611afb03c33df6819359d36f5b382589 , < 7e64474aba78d240f7804f48f2d454dcca78b15f (git)
Affected: 34f26a15611afb03c33df6819359d36f5b382589 , < ac5cda4fae8818cf1963317bb699f7f2f85b60af (git)
Affected: 34f26a15611afb03c33df6819359d36f5b382589 , < 3c9ba2777d6c86025e1ba4186dc5cd930e40ec5f (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.1
Unaffected: 0 , < 6.1 (semver)
Unaffected: 6.1.153 , ≤ 6.1.* (semver)
Unaffected: 6.6.107 , ≤ 6.6.* (semver)
Unaffected: 6.12.48 , ≤ 6.12.* (semver)
Unaffected: 6.16.8 , ≤ 6.16.* (semver)
Unaffected: 6.17 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T17:44:23.968Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/kernfs/file.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "34d9cafd469c69ad85e6a36b4303c78382cf5c79",
              "status": "affected",
              "version": "34f26a15611afb03c33df6819359d36f5b382589",
              "versionType": "git"
            },
            {
              "lessThan": "854baafc00c433cccbe0ab4231b77aeb9b637b77",
              "status": "affected",
              "version": "34f26a15611afb03c33df6819359d36f5b382589",
              "versionType": "git"
            },
            {
              "lessThan": "7e64474aba78d240f7804f48f2d454dcca78b15f",
              "status": "affected",
              "version": "34f26a15611afb03c33df6819359d36f5b382589",
              "versionType": "git"
            },
            {
              "lessThan": "ac5cda4fae8818cf1963317bb699f7f2f85b60af",
              "status": "affected",
              "version": "34f26a15611afb03c33df6819359d36f5b382589",
              "versionType": "git"
            },
            {
              "lessThan": "3c9ba2777d6c86025e1ba4186dc5cd930e40ec5f",
              "status": "affected",
              "version": "34f26a15611afb03c33df6819359d36f5b382589",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/kernfs/file.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.1"
            },
            {
              "lessThan": "6.1",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.153",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.107",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.48",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.16.*",
              "status": "unaffected",
              "version": "6.16.8",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.17",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.153",
                  "versionStartIncluding": "6.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.107",
                  "versionStartIncluding": "6.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.48",
                  "versionStartIncluding": "6.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.16.8",
                  "versionStartIncluding": "6.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.17",
                  "versionStartIncluding": "6.1",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nkernfs: Fix UAF in polling when open file is released\n\nA use-after-free (UAF) vulnerability was identified in the PSI (Pressure\nStall Information) monitoring mechanism:\n\nBUG: KASAN: slab-use-after-free in psi_trigger_poll+0x3c/0x140\nRead of size 8 at addr ffff3de3d50bd308 by task systemd/1\n\npsi_trigger_poll+0x3c/0x140\ncgroup_pressure_poll+0x70/0xa0\ncgroup_file_poll+0x8c/0x100\nkernfs_fop_poll+0x11c/0x1c0\nep_item_poll.isra.0+0x188/0x2c0\n\nAllocated by task 1:\ncgroup_file_open+0x88/0x388\nkernfs_fop_open+0x73c/0xaf0\ndo_dentry_open+0x5fc/0x1200\nvfs_open+0xa0/0x3f0\ndo_open+0x7e8/0xd08\npath_openat+0x2fc/0x6b0\ndo_filp_open+0x174/0x368\n\nFreed by task 8462:\ncgroup_file_release+0x130/0x1f8\nkernfs_drain_open_files+0x17c/0x440\nkernfs_drain+0x2dc/0x360\nkernfs_show+0x1b8/0x288\ncgroup_file_show+0x150/0x268\ncgroup_pressure_write+0x1dc/0x340\ncgroup_file_write+0x274/0x548\n\nReproduction Steps:\n1. Open test/cpu.pressure and establish epoll monitoring\n2. Disable monitoring: echo 0 \u003e test/cgroup.pressure\n3. Re-enable monitoring: echo 1 \u003e test/cgroup.pressure\n\nThe race condition occurs because:\n1. When cgroup.pressure is disabled (echo 0 \u003e cgroup.pressure), it:\n   - Releases PSI triggers via cgroup_file_release()\n   - Frees of-\u003epriv through kernfs_drain_open_files()\n2. While epoll still holds reference to the file and continues polling\n3. Re-enabling (echo 1 \u003e cgroup.pressure) accesses freed of-\u003epriv\n\nepolling\t\t\tdisable/enable cgroup.pressure\nfd=open(cpu.pressure)\nwhile(1)\n...\nepoll_wait\nkernfs_fop_poll\nkernfs_get_active = true\techo 0 \u003e cgroup.pressure\n...\t\t\t\tcgroup_file_show\n\t\t\t\tkernfs_show\n\t\t\t\t// inactive kn\n\t\t\t\tkernfs_drain_open_files\n\t\t\t\tcft-\u003erelease(of);\n\t\t\t\tkfree(ctx);\n\t\t\t\t...\nkernfs_get_active = false\n\t\t\t\techo 1 \u003e cgroup.pressure\n\t\t\t\tkernfs_show\n\t\t\t\tkernfs_activate_one(kn);\nkernfs_fop_poll\nkernfs_get_active = true\ncgroup_file_poll\npsi_trigger_poll\n// UAF\n...\nend: close(fd)\n\nTo address this issue, introduce kernfs_get_active_of() for kernfs open\nfiles to obtain active references. This function will fail if the open file\nhas been released. Replace kernfs_get_active() with kernfs_get_active_of()\nto prevent further operations on released file descriptors."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The attack requires local access to the cgroup2 filesystem \u2014 opening `cpu.pressure` with epoll and writing to `cgroup.pressure` via ordinary file syscalls. There is no network-facing path to `kernfs_fop_poll()`/`cgroup_pressure_write()`.\nAC:L - The reproduction is a deterministic three-step sequence (open+epoll, `echo 0 \u003e cgroup.pressure`, `echo 1 \u003e cgroup.pressure`) fully driven by the attacker, with no timing window to win. The gap between the `kfree()` and the re-activated poll is attacker-controlled and arbitrarily long, allowing reliable heap spraying of the kmalloc-192 slot.\nPR:L - An unprivileged local user suffices: `cgroup_add_file()` stamps created cgroup files with `current_fsuid()`, so any user with a delegated subtree (systemd `user@$UID.service`, containers, rootless podman) owns and can write both `cgroup.pressure` and `cpu.pressure` in a cgroup they `mkdir`. No capability check exists on this path, and cgroup2 is `FS_USERNS_MOUNT`.\nUI:N - The attacker performs the poll and both `cgroup.pressure` writes itself; no victim action is needed. (A privileged poller such as systemd/systemd-oomd can additionally be victimized, but that is not required.)\nS:U - The freed object, the corrupting write, and the resulting compromise all live in the kernel\u0027s own security authority. No VM, IOMMU, or sandbox boundary is crossed.\nC:H - The stale `of-\u003epriv` yields an attacker-controlled `struct psi_trigger *` in `psi_trigger_poll()`, and the subsequent `t-\u003eof` / `of_on(of)` / `atomic_read(\u0026on-\u003eevent)` dereferences turn that into an arbitrary kernel-memory read primitive, disclosing sensitive kernel data.\nI:H - `poll_wait()` on the forged `t-\u003eevent_wait` inserts a wait-queue entry at an attacker-chosen address (arbitrary linked-list write), `cmpxchg(\u0026t-\u003eevent, 1, 0)` adds a conditional write, and the eventual `wake_up()` calls a `wait_queue_entry-\u003efunc` pointer from corrupted memory \u2014 a viable control-flow hijack and local privilege escalation.\nA:H - Even without exploitation the use-after-free reliably produces a KASAN slab-use-after-free / oops on a wild pointer dereference, and a failed spray attempt panics the kernel \u2014 a full denial of service triggerable at will by an unprivileged user."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:05:52.050Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/34d9cafd469c69ad85e6a36b4303c78382cf5c79"
        },
        {
          "url": "https://git.kernel.org/stable/c/854baafc00c433cccbe0ab4231b77aeb9b637b77"
        },
        {
          "url": "https://git.kernel.org/stable/c/7e64474aba78d240f7804f48f2d454dcca78b15f"
        },
        {
          "url": "https://git.kernel.org/stable/c/ac5cda4fae8818cf1963317bb699f7f2f85b60af"
        },
        {
          "url": "https://git.kernel.org/stable/c/3c9ba2777d6c86025e1ba4186dc5cd930e40ec5f"
        }
      ],
      "title": "kernfs: Fix UAF in polling when open file is released",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-39881",
    "datePublished": "2025-09-23T06:00:50.496Z",
    "dateReserved": "2025-04-16T07:20:57.144Z",
    "dateUpdated": "2026-08-05T12:05:52.050Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-39881",
      "date": "2026-09-17",
      "epss": "0.0015",
      "percentile": "0.04574"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-39881\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-09-23T06:15:47.793\",\"lastModified\":\"2026-07-30T06:23:53.553\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nkernfs: Fix UAF in polling when open file is released\\n\\nA use-after-free (UAF) vulnerability was identified in the PSI (Pressure\\nStall Information) monitoring mechanism:\\n\\nBUG: KASAN: slab-use-after-free in psi_trigger_poll+0x3c/0x140\\nRead of size 8 at addr ffff3de3d50bd308 by task systemd/1\\n\\npsi_trigger_poll+0x3c/0x140\\ncgroup_pressure_poll+0x70/0xa0\\ncgroup_file_poll+0x8c/0x100\\nkernfs_fop_poll+0x11c/0x1c0\\nep_item_poll.isra.0+0x188/0x2c0\\n\\nAllocated by task 1:\\ncgroup_file_open+0x88/0x388\\nkernfs_fop_open+0x73c/0xaf0\\ndo_dentry_open+0x5fc/0x1200\\nvfs_open+0xa0/0x3f0\\ndo_open+0x7e8/0xd08\\npath_openat+0x2fc/0x6b0\\ndo_filp_open+0x174/0x368\\n\\nFreed by task 8462:\\ncgroup_file_release+0x130/0x1f8\\nkernfs_drain_open_files+0x17c/0x440\\nkernfs_drain+0x2dc/0x360\\nkernfs_show+0x1b8/0x288\\ncgroup_file_show+0x150/0x268\\ncgroup_pressure_write+0x1dc/0x340\\ncgroup_file_write+0x274/0x548\\n\\nReproduction Steps:\\n1. Open test/cpu.pressure and establish epoll monitoring\\n2. Disable monitoring: echo 0 \u003e test/cgroup.pressure\\n3. Re-enable monitoring: echo 1 \u003e test/cgroup.pressure\\n\\nThe race condition occurs because:\\n1. When cgroup.pressure is disabled (echo 0 \u003e cgroup.pressure), it:\\n   - Releases PSI triggers via cgroup_file_release()\\n   - Frees of-\u003epriv through kernfs_drain_open_files()\\n2. While epoll still holds reference to the file and continues polling\\n3. Re-enabling (echo 1 \u003e cgroup.pressure) accesses freed of-\u003epriv\\n\\nepolling\\t\\t\\tdisable/enable cgroup.pressure\\nfd=open(cpu.pressure)\\nwhile(1)\\n...\\nepoll_wait\\nkernfs_fop_poll\\nkernfs_get_active = true\\techo 0 \u003e cgroup.pressure\\n...\\t\\t\\t\\tcgroup_file_show\\n\\t\\t\\t\\tkernfs_show\\n\\t\\t\\t\\t// inactive kn\\n\\t\\t\\t\\tkernfs_drain_open_files\\n\\t\\t\\t\\tcft-\u003erelease(of);\\n\\t\\t\\t\\tkfree(ctx);\\n\\t\\t\\t\\t...\\nkernfs_get_active = false\\n\\t\\t\\t\\techo 1 \u003e cgroup.pressure\\n\\t\\t\\t\\tkernfs_show\\n\\t\\t\\t\\tkernfs_activate_one(kn);\\nkernfs_fop_poll\\nkernfs_get_active = true\\ncgroup_file_poll\\npsi_trigger_poll\\n// UAF\\n...\\nend: close(fd)\\n\\nTo address this issue, introduce kernfs_get_active_of() for kernfs open\\nfiles to obtain active references. This function will fail if the open file\\nhas been released. Replace kernfs_get_active() with kernfs_get_active_of()\\nto prevent further operations on released file descriptors.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"fs/kernfs/file.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"34f26a15611afb03c33df6819359d36f5b382589\",\"lessThan\":\"34d9cafd469c69ad85e6a36b4303c78382cf5c79\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"34f26a15611afb03c33df6819359d36f5b382589\",\"lessThan\":\"854baafc00c433cccbe0ab4231b77aeb9b637b77\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"34f26a15611afb03c33df6819359d36f5b382589\",\"lessThan\":\"7e64474aba78d240f7804f48f2d454dcca78b15f\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"34f26a15611afb03c33df6819359d36f5b382589\",\"lessThan\":\"ac5cda4fae8818cf1963317bb699f7f2f85b60af\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"34f26a15611afb03c33df6819359d36f5b382589\",\"lessThan\":\"3c9ba2777d6c86025e1ba4186dc5cd930e40ec5f\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"fs/kernfs/file.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.1\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.1\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.153\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.107\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.48\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.16.8\",\"lessThanOrEqual\":\"6.16.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.17\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-416\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.1\",\"versionEndExcluding\":\"6.1.153\",\"matchCriteriaId\":\"91F32939-95B8-4428-B348-702468A36710\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.2\",\"versionEndExcluding\":\"6.6.107\",\"matchCriteriaId\":\"D273EDA6-2CFE-4EBD-B024-62EB057830F3\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.12.48\",\"matchCriteriaId\":\"9652E701-5C8E-49CF-89A5-499E214A5902\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.13\",\"versionEndExcluding\":\"6.16.8\",\"matchCriteriaId\":\"8DA00A4E-AABB-4A69-AB39-67B22D0B36D2\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.17:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"327D22EF-390B-454C-BD31-2ED23C998A1C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.17:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"C730CD9A-D969-4A8E-9522-162AAF7C0EE9\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.17:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"39982C4B-716E-4B2F-8196-FA301F47807D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.17:rc4:*:*:*:*:*:*\",\"matchCriteriaId\":\"340BEEA9-D70D-4290-B502-FBB1032353B1\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.17:rc5:*:*:*:*:*:*\",\"matchCriteriaId\":\"47E4C5C0-079F-4838-971B-8C503D48FCC2\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"FA6FEEC2-9F11-4643-8827-749718254FED\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/34d9cafd469c69ad85e6a36b4303c78382cf5c79\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/3c9ba2777d6c86025e1ba4186dc5cd930e40ec5f\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/7e64474aba78d240f7804f48f2d454dcca78b15f\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/854baafc00c433cccbe0ab4231b77aeb9b637b77\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/ac5cda4fae8818cf1963317bb699f7f2f85b60af\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-07-30T08:58:10+00:00",
      "cve": "CVE-2025-39881",
      "id": "CVE-2025-39881",
      "initial_release_date": "2025-09-23T00:00:00+00:00",
      "product_status:fixed": "1224",
      "product_status:known_not_affected": "112",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: kernfs: Fix UAF in polling when open file is released",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-39881.json",
      "version": "3"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.