CVE-2025-39953
BaseFortify
Publication date: 2025-10-04
Last updated on: 2025-10-06
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| linux | kernel | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-UNKNOWN |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability in the Linux kernel involves a hang (deadlock) that occurs during cgroup testing when repeatedly mounting and unmounting perf_event and net_prio controllers with systemd.unified_cgroup_hierarchy=1. The hang happens in the function cgroup_lock_and_drain_offline() during root cgroup destruction because the root destruction work and offline work are queued on the same workqueue (cgroup_destroy_wq) with max_active=1, causing a circular wait. The root destruction waits for offline completion, but offline work is blocked behind root destruction, leading to a hung task. The fix splits the single workqueue into three dedicated workqueues to avoid this blocking.
How can this vulnerability impact me? :
This vulnerability can cause a hung task in the Linux kernel when certain cgroup controllers are repeatedly mounted and unmounted, potentially leading to system instability or unresponsiveness during these operations. This could affect system performance or availability, especially in environments relying on cgroup resource management.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability manifests as a hung task during repeated mounting and unmounting of perf_event and net_prio controllers with systemd.unified_cgroup_hierarchy=1, specifically hanging in cgroup_lock_and_drain_offline() during root destruction. Detection can be done by running the Linux Test Project (LTP) cgroup tests that involve mounting/unmounting perf_event and net_prio controllers, such as the cgroup_fj_function_perf_event and cgroup_fj_function_net_prio tests. Monitoring for hung tasks or kernel workqueue stalls related to cgroup_destroy_wq can indicate the issue. Specific commands include running LTP tests from https://github.com/linux-test-project/ltp/blob/master/runtest/controllers and checking kernel logs for call traces involving cgroup_lock_and_drain_offline.
What immediate steps should I take to mitigate this vulnerability?
The vulnerability is mitigated by applying the patch that splits the cgroup_destroy_wq workqueue into three dedicated workqueues: cgroup_offline_wq, cgroup_release_wq, and cgroup_free_wq. This eliminates blocking in the CSS free path. Immediate mitigation steps include updating the Linux kernel to a version that includes this fix. Additionally, avoiding repeated mounting and unmounting of perf_event and net_prio controllers with systemd.unified_cgroup_hierarchy=1 until the patch is applied can reduce the risk of encountering the hang.