CVE-2025-39900
Unknown Unknown - Not Provided
BaseFortify

Publication date: 2025-10-01

Last updated on: 2025-12-12

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: net_sched: gen_estimator: fix est_timer() vs CONFIG_PREEMPT_RT=y syzbot reported a WARNING in est_timer() [1] Problem here is that with CONFIG_PREEMPT_RT=y, timer callbacks can be preempted. Adopt preempt_disable_nested()/preempt_enable_nested() to fix this. [1] WARNING: CPU: 0 PID: 16 at ./include/linux/seqlock.h:221 __seqprop_assert include/linux/seqlock.h:221 [inline] WARNING: CPU: 0 PID: 16 at ./include/linux/seqlock.h:221 est_timer+0x6dc/0x9f0 net/core/gen_estimator.c:93 Modules linked in: CPU: 0 UID: 0 PID: 16 Comm: ktimers/0 Not tainted syzkaller #0 PREEMPT_{RT,(full)} Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 RIP: 0010:__seqprop_assert include/linux/seqlock.h:221 [inline] RIP: 0010:est_timer+0x6dc/0x9f0 net/core/gen_estimator.c:93 Call Trace: <TASK> call_timer_fn+0x17e/0x5f0 kernel/time/timer.c:1747 expire_timers kernel/time/timer.c:1798 [inline] __run_timers kernel/time/timer.c:2372 [inline] __run_timer_base+0x648/0x970 kernel/time/timer.c:2384 run_timer_base kernel/time/timer.c:2393 [inline] run_timer_softirq+0xb7/0x180 kernel/time/timer.c:2403 handle_softirqs+0x22c/0x710 kernel/softirq.c:579 __do_softirq kernel/softirq.c:613 [inline] run_ktimerd+0xcf/0x190 kernel/softirq.c:1043 smpboot_thread_fn+0x53f/0xa60 kernel/smpboot.c:160 kthread+0x70e/0x8a0 kernel/kthread.c:463 ret_from_fork+0x3fc/0x770 arch/x86/kernel/process.c:148 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 </TASK>
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2025-10-01
Last Modified
2025-12-12
Generated
2026-06-16
AI Q&A
2025-10-01
EPSS Evaluated
2026-06-15
NVD
CVE-2025-39900
Affected Vendors & Products
Showing 6 associated CPEs
Vendor Product Version / Range
linux linux_kernel From 6.12 (inc) to 6.12.46 (exc)
linux linux_kernel From 6.13 (inc) to 6.16.6 (exc)
linux linux_kernel 6.17
linux linux_kernel 6.17
linux linux_kernel 6.17
linux linux_kernel 6.17
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-NVD-CWE-noinfo
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

This vulnerability is in the Linux kernel's net_sched component, specifically in the gen_estimator's est_timer() function. When the kernel is configured with CONFIG_PREEMPT_RT=y (real-time preemption), timer callbacks can be preempted, which was not properly handled. This caused warnings and potential issues due to improper handling of preemption in timer callbacks. The fix involved adopting preempt_disable_nested() and preempt_enable_nested() to properly manage preemption in this context.

Impact Analysis

The vulnerability can cause warnings and instability in the Linux kernel when running with real-time preemption enabled (CONFIG_PREEMPT_RT=y). Timer callbacks may be preempted unexpectedly, potentially leading to race conditions or inconsistent behavior in network scheduling. This could affect system reliability and performance, especially in real-time or time-sensitive environments.

Detection Guidance

This vulnerability can be detected by monitoring for WARNING messages related to est_timer() in the kernel logs, especially messages referencing seqlock.h and gen_estimator.c. You can check the kernel log using commands like 'dmesg | grep est_timer' or 'journalctl -k | grep est_timer' to look for such warnings.

Mitigation Strategies

To mitigate this vulnerability, update the Linux kernel to a version where the fix adopting preempt_disable_nested()/preempt_enable_nested() in est_timer() has been applied. This resolves the issue with timer callbacks being preempted when CONFIG_PREEMPT_RT=y. If updating is not immediately possible, consider disabling CONFIG_PREEMPT_RT or avoiding configurations that enable it until a patched kernel is deployed.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2025-39900. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart