CVE-2025-39881— kernfs: Fix UAF in polling when open file is released
Quick assessment
Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于PSI监控机制中存在释放后重用问题，可能导致内存损坏。
Affected Version Matrix 12
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Linux | Linux | 34f26a15611afb03c33df6819359d36f5b382589< 34d9cafd469c69ad85e6a36b4303c78382cf5c79 |
affected |
34f26a15611afb03c33df6819359d36f5b382589< 854baafc00c433cccbe0ab4231b77aeb9b637b77 |
affected | ||
34f26a15611afb03c33df6819359d36f5b382589< 7e64474aba78d240f7804f48f2d454dcca78b15f |
affected | ||
34f26a15611afb03c33df6819359d36f5b382589< ac5cda4fae8818cf1963317bb699f7f2f85b60af |
affected | ||
34f26a15611afb03c33df6819359d36f5b382589< 3c9ba2777d6c86025e1ba4186dc5cd930e40ec5f |
affected | ||
6.1 |
affected | ||
< 6.1 |
unaffected | ||
6.1.153≤ 6.1.* |
unaffected | ||
| … +4 more rows | |||
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2025-39881
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
kernfs: Fix UAF in polling when open file is released
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved:
kernfs: Fix UAF in polling when open file is released
A use-after-free (UAF) vulnerability was identified in the PSI (Pressure
Stall Information) monitoring mechanism:
BUG: KASAN: slab-use-after-free in psi_trigger_poll+0x3c/0x140
Read of size 8 at addr ffff3de3d50bd308 by task systemd/1
psi_trigger_poll+0x3c/0x140
cgroup_pressure_poll+0x70/0xa0
cgroup_file_poll+0x8c/0x100
kernfs_fop_poll+0x11c/0x1c0
ep_item_poll.isra.0+0x188/0x2c0
Allocated by task 1:
cgroup_file_open+0x88/0x388
kernfs_fop_open+0x73c/0xaf0
do_dentry_open+0x5fc/0x1200
vfs_open+0xa0/0x3f0
do_open+0x7e8/0xd08
path_openat+0x2fc/0x6b0
do_filp_open+0x174/0x368
Freed by task 8462:
cgroup_file_release+0x130/0x1f8
kernfs_drain_open_files+0x17c/0x440
kernfs_drain+0x2dc/0x360
kernfs_show+0x1b8/0x288
cgroup_file_show+0x150/0x268
cgroup_pressure_write+0x1dc/0x340
cgroup_file_write+0x274/0x548
Reproduction Steps:
1. Open test/cpu.pressure and establish epoll monitoring
2. Disable monitoring: echo 0 > test/cgroup.pressure
3. Re-enable monitoring: echo 1 > test/cgroup.pressure
The race condition occurs because:
1. When cgroup.pressure is disabled (echo 0 > cgroup.pressure), it:
- Releases PSI triggers via cgroup_file_release()
- Frees of->priv through kernfs_drain_open_files()
2. While epoll still holds reference to the file and continues polling
3. Re-enabling (echo 1 > cgroup.pressure) accesses freed of->priv
epolling disable/enable cgroup.pressure
fd=open(cpu.pressure)
while(1)
...
epoll_wait
kernfs_fop_poll
kernfs_get_active = true echo 0 > cgroup.pressure
... cgroup_file_show
kernfs_show
// inactive kn
kernfs_drain_open_files
cft->release(of);
kfree(ctx);
...
kernfs_get_active = false
echo 1 > cgroup.pressure
kernfs_show
kernfs_activate_one(kn);
kernfs_fop_poll
kernfs_get_active = true
cgroup_file_poll
psi_trigger_poll
// UAF
...
end: close(fd)
To address this issue, introduce kernfs_get_active_of() for kernfs open
files to obtain active references. This function will fail if the open file
has been released. Replace kernfs_get_active() with kernfs_get_active_of()
to prevent further operations on released file descriptors.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Linux kernel 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于PSI监控机制中存在释放后重用问题，可能导致内存损坏。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2025-39881
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2025-39881
请登录查看更多情报信息。
Same Patch Batch · Linux · 2025-09-23 · 21 CVEs total
| CVE-2025-39880 | 9.8 CRITICAL | libceph: fix invalid accesses to ceph_connection_v1_info |
| CVE-2025-39869 | 8.4 HIGH | dmaengine: ti: edma: Fix memory allocation size for queue_priority_map |
| CVE-2025-39882 | 8.4 HIGH | drm/mediatek: fix potential OF node use-after-free |
| CVE-2025-39888 | 7.8 HIGH | fuse: Block access to folio overlimit |
| CVE-2025-39872 | 7.8 HIGH | hsr: hold rcu and dev lock for hsr_get_port_ndev |
| CVE-2025-39873 | 7.8 HIGH | can: xilinx_can: xcan_write_frame(): fix use-after-free of transmitted SKB |
| CVE-2025-39868 | 7.8 HIGH | erofs: fix runtime warning on truncate_folio_batch_exceptionals() |
| CVE-2025-39879 | ceph: always call ceph_shift_unused_folios_left() | |
| CVE-2025-39887 | tracing/osnoise: Fix null-ptr-deref in bitmap_parselist() | |
| CVE-2025-39885 | ocfs2: fix recursive semaphore deadlock in fiemap call | |
| CVE-2025-39886 | bpf: Tell memcg to use allow_spinning=false path in bpf_timer_init() | |
| CVE-2025-39883 | mm/memory-failure: fix VM_BUG_ON_PAGE(PagePoisoned(page)) when unpoison memory | |
| CVE-2025-39884 | btrfs: fix subvolume deletion lockup caused by inodes xarray race | |
| CVE-2025-39878 | ceph: fix crash after fscrypt_encrypt_pagecache_blocks() error | |
| CVE-2025-39877 | mm/damon/sysfs: fix use-after-free in state_show() | |
| CVE-2025-39876 | net: fec: Fix possible NPD in fec_enet_phy_reset_after_clk_enable() | |
| CVE-2025-39874 | macsec: sync features on RTM_NEWLINK | |
| CVE-2025-39875 | igb: Fix NULL pointer dereference in ethtool loopback test | |
| CVE-2025-39871 | dmaengine: idxd: Remove improper idxd_free | |
| CVE-2025-39870 | dmaengine: idxd: Fix double free in idxd_setup_wqs() |
IV. Related Vulnerabilities
Same product: Linux
-
CVE-2023-7356
Bluetooth: ISO: Copy BASE if service data matches EIR_BAA_SE -
CVE-2026-98869
bpf: Infer zext_dst based on static register liveness analys -
CVE-2026-98868
dm-pcache: reject a kset that overruns its segment -
CVE-2026-98867
dm-pcache: bound the logical key offset from persistent memo -
CVE-2026-98866
sched/cache: Introduce task_struct->sched_cache_grp to fix U
Same vendor: Linux
-
CVE-2023-7356
Bluetooth: ISO: Copy BASE if service data matches EIR_BAA_SE -
CVE-2026-98869
bpf: Infer zext_dst based on static register liveness analys -
CVE-2026-98868
dm-pcache: reject a kset that overruns its segment -
CVE-2026-98867
dm-pcache: bound the logical key offset from persistent memo -
CVE-2026-98866
sched/cache: Introduce task_struct->sched_cache_grp to fix U
V. Comments for CVE-2025-39881
No comments yet