CVE-2024-39486

The record

In the Linux kernel, the following vulnerability has been resolved: drm/drm_file: Fix pid refcounting race <maarten.lankhorst@linux.intel.com>, Maxime Ripard <mripard@kernel.org>, Thomas Zimmermann <tzimmermann@suse.de> filp->pid is supposed to be a refcounted pointer; however, before this patch, drm_file_update_pid() only increments the refcount of a struct pid after storing a pointer to it in filp->pid and dropping the dev->filelist_mutex, making the following race possible: process A process B ========= ========= begin drm_file_update_pid mutex_lock(&dev->filelist_mutex) rcu_replace_pointer(filp->pid, <pid B>, 1) mutex_unlock(&dev->filelist_mutex) begin drm_file_update_pid mutex_lock(&dev->filelist_mutex) rcu_replace_pointer(filp->pid, <pid A>, 1) mutex_unlock(&dev->filelist_mutex) get_pid(<pid A>) synchronize_rcu() put_pid(<pid B>) *** pid B reaches refcount 0 and is freed here *** get_pid(<pid B>) *** UAF *** synchronize_rcu() put_pid(<pid A>) As far as I know, this race can only occur with CONFIG_PREEMPT_RCU=y because it requires RCU to detect a quiescent state in code that is not explicitly calling into the scheduler. This race leads to use-after-free of a "struct pid". It is probably somewhat hard to hit because process A has to pass through a synchronize_rcu() operation while process B is between mutex_unlock() and get_pid(). Fix it by ensuring that by the time a pointer to the current task's pid is stored in the file, an extra reference to the pid has been taken. This fix also removes the condition for synchronize_rcu(); I think that optimization is unnecessary complexity, since in that case we would usually have bailed out on the lockless check above.

Affected packages

Related vulnerabilities

• CVE-2025-39682 In the Linux kernel, the following vulnerability has been resolved: tls: fix handling of… Also affects linux
• CVE-2025-38562 In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix null… Also affects linux
• CVE-2023-3867 In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix out of… Also affects linux
• CVE-2023-3865 In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix… Also affects linux
• CVE-2025-38352 In the Linux kernel, the following vulnerability has been resolved: posix-cpu-timers: fix… Also affects linux
• CVE-2025-37924 In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix… Also affects linux
• CVE-2025-22037 In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix null… Also affects linux
• CVE-2025-21813 In the Linux kernel, the following vulnerability has been resolved: timers/migration: Fix… Also affects linux