{
    "dataType": "CVE_RECORD",
    "dataVersion": "5.2",
    "cveMetadata": {
        "cveId": "CVE-2025-39881",
        "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "state": "PUBLISHED",
        "assignerShortName": "Linux",
        "dateReserved": "2025-04-16T07:20:57.144Z",
        "datePublished": "2025-09-23T06:00:50.496Z",
        "dateUpdated": "2026-08-05T12:05:52.050Z"
    },
    "containers": {
        "cna": {
            "providerMetadata": {
                "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
                "shortName": "Linux",
                "dateUpdated": "2026-08-05T12:05:52.050Z"
            },
            "descriptions": [
                {
                    "lang": "en",
                    "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nkernfs: Fix UAF in polling when open file is released\n\nA use-after-free (UAF) vulnerability was identified in the PSI (Pressure\nStall Information) monitoring mechanism:\n\nBUG: KASAN: slab-use-after-free in psi_trigger_poll+0x3c/0x140\nRead of size 8 at addr ffff3de3d50bd308 by task systemd/1\n\npsi_trigger_poll+0x3c/0x140\ncgroup_pressure_poll+0x70/0xa0\ncgroup_file_poll+0x8c/0x100\nkernfs_fop_poll+0x11c/0x1c0\nep_item_poll.isra.0+0x188/0x2c0\n\nAllocated by task 1:\ncgroup_file_open+0x88/0x388\nkernfs_fop_open+0x73c/0xaf0\ndo_dentry_open+0x5fc/0x1200\nvfs_open+0xa0/0x3f0\ndo_open+0x7e8/0xd08\npath_openat+0x2fc/0x6b0\ndo_filp_open+0x174/0x368\n\nFreed by task 8462:\ncgroup_file_release+0x130/0x1f8\nkernfs_drain_open_files+0x17c/0x440\nkernfs_drain+0x2dc/0x360\nkernfs_show+0x1b8/0x288\ncgroup_file_show+0x150/0x268\ncgroup_pressure_write+0x1dc/0x340\ncgroup_file_write+0x274/0x548\n\nReproduction Steps:\n1. Open test/cpu.pressure and establish epoll monitoring\n2. Disable monitoring: echo 0 > test/cgroup.pressure\n3. Re-enable monitoring: echo 1 > test/cgroup.pressure\n\nThe race condition occurs because:\n1. When cgroup.pressure is disabled (echo 0 > cgroup.pressure), it:\n   - Releases PSI triggers via cgroup_file_release()\n   - Frees of->priv through kernfs_drain_open_files()\n2. While epoll still holds reference to the file and continues polling\n3. Re-enabling (echo 1 > cgroup.pressure) accesses freed of->priv\n\nepolling\t\t\tdisable/enable cgroup.pressure\nfd=open(cpu.pressure)\nwhile(1)\n...\nepoll_wait\nkernfs_fop_poll\nkernfs_get_active = true\techo 0 > cgroup.pressure\n...\t\t\t\tcgroup_file_show\n\t\t\t\tkernfs_show\n\t\t\t\t// inactive kn\n\t\t\t\tkernfs_drain_open_files\n\t\t\t\tcft->release(of);\n\t\t\t\tkfree(ctx);\n\t\t\t\t...\nkernfs_get_active = false\n\t\t\t\techo 1 > cgroup.pressure\n\t\t\t\tkernfs_show\n\t\t\t\tkernfs_activate_one(kn);\nkernfs_fop_poll\nkernfs_get_active = true\ncgroup_file_poll\npsi_trigger_poll\n// UAF\n...\nend: close(fd)\n\nTo address this issue, introduce kernfs_get_active_of() for kernfs open\nfiles to obtain active references. This function will fail if the open file\nhas been released. Replace kernfs_get_active() with kernfs_get_active_of()\nto prevent further operations on released file descriptors."
                }
            ],
            "metrics": [
                {
                    "cvssV3_1": {
                        "version": "3.1",
                        "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                        "baseScore": 7.8,
                        "baseSeverity": "HIGH"
                    },
                    "scenarios": [
                        {
                            "lang": "en",
                            "value": "AV:L - The attack requires local access to the cgroup2 filesystem — opening `cpu.pressure` with epoll and writing to `cgroup.pressure` via ordinary file syscalls. There is no network-facing path to `kernfs_fop_poll()`/`cgroup_pressure_write()`.\nAC:L - The reproduction is a deterministic three-step sequence (open+epoll, `echo 0 > cgroup.pressure`, `echo 1 > cgroup.pressure`) fully driven by the attacker, with no timing window to win. The gap between the `kfree()` and the re-activated poll is attacker-controlled and arbitrarily long, allowing reliable heap spraying of the kmalloc-192 slot.\nPR:L - An unprivileged local user suffices: `cgroup_add_file()` stamps created cgroup files with `current_fsuid()`, so any user with a delegated subtree (systemd `user@$UID.service`, containers, rootless podman) owns and can write both `cgroup.pressure` and `cpu.pressure` in a cgroup they `mkdir`. No capability check exists on this path, and cgroup2 is `FS_USERNS_MOUNT`.\nUI:N - The attacker performs the poll and both `cgroup.pressure` writes itself; no victim action is needed. (A privileged poller such as systemd/systemd-oomd can additionally be victimized, but that is not required.)\nS:U - The freed object, the corrupting write, and the resulting compromise all live in the kernel's own security authority. No VM, IOMMU, or sandbox boundary is crossed.\nC:H - The stale `of->priv` yields an attacker-controlled `struct psi_trigger *` in `psi_trigger_poll()`, and the subsequent `t->of` / `of_on(of)` / `atomic_read(&on->event)` dereferences turn that into an arbitrary kernel-memory read primitive, disclosing sensitive kernel data.\nI:H - `poll_wait()` on the forged `t->event_wait` inserts a wait-queue entry at an attacker-chosen address (arbitrary linked-list write), `cmpxchg(&t->event, 1, 0)` adds a conditional write, and the eventual `wake_up()` calls a `wait_queue_entry->func` pointer from corrupted memory — a viable control-flow hijack and local privilege escalation.\nA:H - Even without exploitation the use-after-free reliably produces a KASAN slab-use-after-free / oops on a wild pointer dereference, and a failed spray attempt panics the kernel — a full denial of service triggerable at will by an unprivileged user."
                        }
                    ]
                }
            ],
            "affected": [
                {
                    "product": "Linux",
                    "vendor": "Linux",
                    "defaultStatus": "unaffected",
                    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                    "programFiles": [
                        "fs/kernfs/file.c"
                    ],
                    "versions": [
                        {
                            "version": "34f26a15611afb03c33df6819359d36f5b382589",
                            "lessThan": "34d9cafd469c69ad85e6a36b4303c78382cf5c79",
                            "status": "affected",
                            "versionType": "git"
                        },
                        {
                            "version": "34f26a15611afb03c33df6819359d36f5b382589",
                            "lessThan": "854baafc00c433cccbe0ab4231b77aeb9b637b77",
                            "status": "affected",
                            "versionType": "git"
                        },
                        {
                            "version": "34f26a15611afb03c33df6819359d36f5b382589",
                            "lessThan": "7e64474aba78d240f7804f48f2d454dcca78b15f",
                            "status": "affected",
                            "versionType": "git"
                        },
                        {
                            "version": "34f26a15611afb03c33df6819359d36f5b382589",
                            "lessThan": "ac5cda4fae8818cf1963317bb699f7f2f85b60af",
                            "status": "affected",
                            "versionType": "git"
                        },
                        {
                            "version": "34f26a15611afb03c33df6819359d36f5b382589",
                            "lessThan": "3c9ba2777d6c86025e1ba4186dc5cd930e40ec5f",
                            "status": "affected",
                            "versionType": "git"
                        }
                    ]
                },
                {
                    "product": "Linux",
                    "vendor": "Linux",
                    "defaultStatus": "affected",
                    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                    "programFiles": [
                        "fs/kernfs/file.c"
                    ],
                    "versions": [
                        {
                            "version": "6.1",
                            "status": "affected"
                        },
                        {
                            "version": "0",
                            "lessThan": "6.1",
                            "status": "unaffected",
                            "versionType": "semver"
                        },
                        {
                            "version": "6.1.153",
                            "lessThanOrEqual": "6.1.*",
                            "status": "unaffected",
                            "versionType": "semver"
                        },
                        {
                            "version": "6.6.107",
                            "lessThanOrEqual": "6.6.*",
                            "status": "unaffected",
                            "versionType": "semver"
                        },
                        {
                            "version": "6.12.48",
                            "lessThanOrEqual": "6.12.*",
                            "status": "unaffected",
                            "versionType": "semver"
                        },
                        {
                            "version": "6.16.8",
                            "lessThanOrEqual": "6.16.*",
                            "status": "unaffected",
                            "versionType": "semver"
                        },
                        {
                            "version": "6.17",
                            "lessThanOrEqual": "*",
                            "status": "unaffected",
                            "versionType": "original_commit_for_fix"
                        }
                    ]
                }
            ],
            "cpeApplicability": [
                {
                    "nodes": [
                        {
                            "operator": "OR",
                            "negate": false,
                            "cpeMatch": [
                                {
                                    "vulnerable": true,
                                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                                    "versionStartIncluding": "6.1",
                                    "versionEndExcluding": "6.1.153"
                                },
                                {
                                    "vulnerable": true,
                                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                                    "versionStartIncluding": "6.1",
                                    "versionEndExcluding": "6.6.107"
                                },
                                {
                                    "vulnerable": true,
                                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                                    "versionStartIncluding": "6.1",
                                    "versionEndExcluding": "6.12.48"
                                },
                                {
                                    "vulnerable": true,
                                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                                    "versionStartIncluding": "6.1",
                                    "versionEndExcluding": "6.16.8"
                                },
                                {
                                    "vulnerable": true,
                                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                                    "versionStartIncluding": "6.1",
                                    "versionEndExcluding": "6.17"
                                }
                            ]
                        }
                    ]
                }
            ],
            "references": [
                {
                    "url": "https://git.kernel.org/stable/c/34d9cafd469c69ad85e6a36b4303c78382cf5c79"
                },
                {
                    "url": "https://git.kernel.org/stable/c/854baafc00c433cccbe0ab4231b77aeb9b637b77"
                },
                {
                    "url": "https://git.kernel.org/stable/c/7e64474aba78d240f7804f48f2d454dcca78b15f"
                },
                {
                    "url": "https://git.kernel.org/stable/c/ac5cda4fae8818cf1963317bb699f7f2f85b60af"
                },
                {
                    "url": "https://git.kernel.org/stable/c/3c9ba2777d6c86025e1ba4186dc5cd930e40ec5f"
                }
            ],
            "title": "kernfs: Fix UAF in polling when open file is released",
            "x_generator": {
                "engine": "bippy-1.2.0"
            }
        },
        "adp": [
            {
                "title": "CVE Program Container",
                "references": [
                    {
                        "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html"
                    }
                ],
                "providerMetadata": {
                    "orgId": "af854a3a-2127-422b-91ae-364da2661108",
                    "shortName": "CVE",
                    "dateUpdated": "2025-11-03T17:44:23.968Z"
                }
            }
        ]
    }
}