CVE-2025-39866: Linux Kernel Use-After-Free Vulnerability

CVE-2025-39866 Overview

CVE-2025-39866 is a use-after-free vulnerability [CWE-416] in the Linux kernel filesystem writeback subsystem. The flaw resides in __mark_inode_dirty() within fs/fs-writeback.c and triggers when the function accesses a bdi_writeback structure that is concurrently being switched by inode_switch_wbs_work_fn. A local, low-privileged user performing filesystem writes can race with cgroup writeback switching to reference freed memory. Successful exploitation results in kernel memory corruption that can lead to denial of service or local privilege escalation. The issue affects multiple stable Linux kernel branches, including 6.17-rc1 and 6.17-rc2, and has been addressed across seven upstream stable commits.

Critical Impact
Local attackers can trigger kernel use-after-free during filesystem writes, potentially leading to memory corruption, kernel crashes, or privilege escalation on affected Linux systems.

Affected Products

Linux Kernel (multiple stable branches, including 6.17-rc1 and 6.17-rc2)
Debian Linux 11.0
Siemens products referenced in advisories SSA-019113, SSA-032379, and SSA-082556

Discovery Timeline

2025-09-19 - CVE-2025-39866 published to the National Vulnerability Database (NVD)
2026-07-14 - Last updated in NVD database

Technical Details for CVE-2025-39866

Vulnerability Analysis

The vulnerability is a use-after-free race condition in the Linux kernel's per-cgroup writeback (cgwb) infrastructure. When a process calls __mark_inode_dirty() during a buffered write, the function attaches the inode to a bdi_writeback (wb) structure through locked_inode_to_wb_and_lock_list(). The inode spinlock is released after retrieving inode->i_wb, leaving a window in which a concurrent kworker running inode_switch_wbs_work_fn can complete a writeback switch and release the old wb via wb_put_many() and cgwb_release().

After the old wb has been freed, __mark_inode_dirty() proceeds to call wb_wakeup_delayed() on the stale pointer, dereferencing freed kernel memory. The reported crash occurred in kernel 6.6.56 during an ext4_buffered_write_iter() call path originating from a normal write() syscall, confirming the issue is reachable from unprivileged user space with write access to a filesystem.

Root Cause

The root cause is insufficient lock coverage in __mark_inode_dirty(). The inode->i_lock spinlock is dropped before wb_wakeup_delayed() executes, allowing inode_do_switch_wbs to reassign inode->i_wb = new_wb and drop the last reference on the old wb. The upstream fix extends the hold time of inode->i_lock until wb_wakeup_delayed() completes, preventing the concurrent switch from freeing the wb while it is still in use.

Attack Vector

Exploitation requires local access with permission to write to a filesystem that uses cgroup-aware writeback, such as ext4. An attacker triggers concurrent filesystem writes while inducing writeback switching between memory cgroups, for example by moving processes across cgroups under write load. Winning the race causes the kernel to dereference a freed bdi_writeback structure, producing a kernel crash or, with heap grooming, potential controlled memory corruption suitable for privilege escalation. The vulnerability does not require user interaction and executes entirely within kernel context.

See the upstream kernel patch commit for technical details on the fix.

Detection Methods for CVE-2025-39866

Indicators of Compromise

Kernel oops or panic entries in dmesg or /var/log/kern.log referencing __mark_inode_dirty+0x124/0x418 or nearby offsets
Call traces containing generic_update_time, file_modified, and ext4_buffered_write_iter culminating in a fault inside writeback code
KASAN use-after-free reports naming bdi_writeback or cgwb_release on kernels built with CONFIG_KASAN
Unexpected kernel crashes on hosts running workloads that frequently move processes across memory cgroups

Detection Strategies

Inventory running kernel versions with uname -r and compare against the fixed commits listed in the upstream stable tree
Enable KASAN in test environments to surface latent use-after-free conditions in the writeback path
Correlate kernel crash telemetry from endpoints with cgroup activity and I/O-intensive workloads to identify race exposure
Monitor for unexpected process termination or kernel restarts on multi-tenant Linux hosts using cgroup v2 writeback

Monitoring Recommendations

Forward kernel logs and crash dumps to a centralized SIEM or data lake for cross-host correlation
Alert on repeated kernel oops signatures matching the __mark_inode_dirty call stack
Track patch compliance across the Linux fleet using configuration management tooling
Baseline normal writeback and cgroup switching activity to detect anomalous patterns consistent with race exploitation attempts

How to Mitigate CVE-2025-39866

Immediate Actions Required

Apply the upstream kernel patches from the seven stable commits published on git.kernel.org to all affected systems
Install the Debian security update announced in the Debian LTS Announcement for Debian 11 hosts
Review Siemens advisories SSA-019113, SSA-032379, and SSA-082556 for affected industrial products
Restrict local shell access on shared or multi-tenant Linux hosts until patches are deployed

Patch Information

The fix is available across multiple stable branches through the following commits: 1edc2feb9c75, b187c9761119, bf89b1f87c72, c8c14adf80bd, d02d2c98d257, e2a14bbae5d8, and e63052921f1b. The patch extends inode->i_lock coverage in __mark_inode_dirty() to encompass wb_wakeup_delayed(), closing the race with inode_switch_wbs_work_fn. Distribution kernels should be updated to versions incorporating these commits.

Workarounds

Disable cgroup writeback where operationally acceptable to eliminate the race window with inode_switch_wbs_work_fn
Limit unprivileged users' ability to move processes between memory cgroups by tightening cgroup delegation and cgroup.procs permissions
Reduce concurrent write workloads on shared hosts pending patch deployment
Use kernel Live Patching (kpatch, kGraft, Ksplice) where supported by the distribution to apply the fix without reboot

bash

# Verify current kernel version and check for the fix
uname -r

# Debian/Ubuntu: update kernel packages
sudo apt update && sudo apt upgrade linux-image-$(uname -r | cut -d- -f2-)
sudo reboot

# RHEL/Rocky/Alma: update kernel packages
sudo dnf update kernel
sudo reboot

# Optional: restrict cgroup delegation to reduce race exposure
# Ensure only trusted users can write to cgroup.procs
find /sys/fs/cgroup -name 'cgroup.procs' -exec ls -l {} \;