CVE-2025-39877
BaseFortify
Publication date: 2025-09-23
Last updated on: 2025-11-03
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| linux | linux_kernel | 6.1.153-1 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-UNKNOWN |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is a use-after-free race condition in the Linux kernel's mm/damon/sysfs component. Specifically, the function state_show() reads a pointer (kdamond->damon_ctx) without holding the necessary damon_sysfs_lock, which can lead to the context being freed by another thread simultaneously. This causes state_show() to access freed memory, resulting in undefined behavior or potential crashes. The issue arises because state_show() does not lock damon_sysfs_lock before dereferencing the context, unlike other functions that properly lock it.
How can this vulnerability impact me? :
This vulnerability can lead to use-after-free conditions in the Linux kernel, which may cause system instability, crashes, or potentially allow an attacker to execute arbitrary code or escalate privileges by exploiting the race condition. The exact impact depends on the environment and how the vulnerable code is used, but it generally undermines system reliability and security.
What immediate steps should I take to mitigate this vulnerability?
Apply the patch that fixes the use-after-free race condition by ensuring damon_sysfs_lock is held before dereferencing kdamond->damon_ctx in state_show(). This fix mirrors the locking used in pid_show() and prevents the race condition. Until patched, avoid using or exposing the affected sysfs interfaces related to damon to reduce risk.