CVE-2025-39881 Overview
CVE-2025-39881 is a use-after-free (UAF) vulnerability [CWE-416] in the Linux kernel's kernfs subsystem. The flaw affects the Pressure Stall Information (PSI) monitoring mechanism used by cgroup pressure files. A race condition between epoll polling and cgroup pressure enable/disable operations allows a local user to trigger access to freed memory via psi_trigger_poll(). The vulnerability affects multiple stable Linux kernel branches and Debian Linux 11.
Critical Impact
A local, low-privileged attacker can trigger a kernel use-after-free through PSI polling, leading to memory corruption, kernel crash, or potential local privilege escalation.
Affected Products
- Linux Kernel (multiple stable branches, including 6.17 release candidates rc1–rc5)
- Debian Linux 11
- Systems using cgroup PSI monitoring with epoll
Discovery Timeline
- 2025-09-23 - CVE-2025-39881 published to NVD
- 2026-07-30 - Last updated in NVD database
Technical Details for CVE-2025-39881
Vulnerability Analysis
The vulnerability resides in the interaction between kernfs open-file lifecycle management and PSI trigger polling. When a process opens a cgroup pressure file such as cpu.pressure and registers it with epoll, the kernel maintains a struct kernfs_open_file referenced through of->priv. Writing 0 to cgroup.pressure disables monitoring and triggers cgroup_file_release(), which invokes kernfs_drain_open_files() and frees the PSI trigger context. Concurrent epoll polling still holds a reference to the file descriptor.
Re-enabling monitoring by writing 1 to cgroup.pressure re-activates the kernfs node without restoring the freed of->priv. The next poll invocation traverses kernfs_fop_poll → cgroup_file_poll → cgroup_pressure_poll → psi_trigger_poll, dereferencing freed slab memory. KASAN reports a slab-use-after-free read of size 8 in psi_trigger_poll+0x3c/0x140.
Root Cause
The root cause is that kernfs_get_active() returns success for a re-activated kernfs node even after kernfs_drain_open_files() has released the associated open-file context. The active-reference API does not track whether the specific open file has already been drained and its private data freed.
Attack Vector
Exploitation requires local access with the ability to open cgroup pressure files and toggle cgroup.pressure. The reproduction pattern is: open test/cpu.pressure, register it with epoll, then race echo 0 > test/cgroup.pressure against echo 1 > test/cgroup.pressure while epoll continues polling. The freed of->priv is accessed by psi_trigger_poll(), producing memory corruption exploitable for privilege escalation or denial of service.
No verified public exploit code is available. See the kernel commit ac5cda4 for the upstream fix, which introduces kernfs_get_active_of() to obtain active references safely and fail when the open file has been released.
Detection Methods for CVE-2025-39881
Indicators of Compromise
- Kernel oops or KASAN reports referencing psi_trigger_poll, cgroup_pressure_poll, or kernfs_fop_poll in the call stack.
- Unexpected kernel panics on systems running cgroup v2 workloads that use PSI monitoring.
- Processes repeatedly opening cpu.pressure, memory.pressure, or io.pressure while another process writes to cgroup.pressure.
Detection Strategies
- Enable KASAN on test kernels to surface use-after-free reads in the kernfs and PSI code paths.
- Audit dmesg and /var/log/kern.log for slab-use-after-free traces mentioning psi_trigger_poll.
- Monitor eBPF or auditd events for suspicious sequences of open() on pressure files combined with writes to cgroup.pressure.
Monitoring Recommendations
- Track processes performing rapid write toggles on cgroup.pressure from non-privileged contexts.
- Alert on kernel crash dumps referencing kernfs_drain_open_files in the freed-by stack trace.
- Correlate container-workload activity with kernel-log anomalies to identify tenants attempting the race.
How to Mitigate CVE-2025-39881
Immediate Actions Required
- Apply the upstream kernel fixes referenced in the kernel.org stable commits as soon as vendor packages are available.
- On Debian systems, install updates from the Debian LTS Announcement.
- Restrict local, untrusted user access on multi-tenant hosts until patches are deployed.
Patch Information
The fix introduces kernfs_get_active_of() for kernfs open files, replacing kernfs_get_active() in polling paths. This new helper fails when the open file has already been released, preventing dereference of freed of->priv. Merged commits include 34d9caf, 3c9ba27, 7e64474, 854baaf, and ac5cda4.
Workarounds
- Restrict write access to cgroup.pressure interfaces via cgroup delegation policies where feasible.
- Disable PSI monitoring for untrusted workloads by setting psi=0 on the kernel command line where the feature is not required.
- Limit container runtimes' ability to expose pressure file toggling to non-root users inside containers.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
