CVE-2025-39866
High · 7.8CVSS
7.8
EPSS
0.3%
Published
Sep 19, 2025
CISA due date
—
Cloudanix analysis
A flaw in the Linux kernel's handling of file writes can let a local user crash the system or potentially gain higher privileges until the kernel is updated.
- Exploitation
- Local Privilege
- Attacker needs
- Low Privilege
- Complexity
- Moderate
- Impact
- Full Compromise
- Component
- OS kernel
- Class
- Use After Free
- Remediation
- Patch
- Effort
- Medium
- Patch risk
- Medium
What it actually does
Use-after-free in __mark_inode_dirty() when a concurrent inode writeback switch releases the old bdi_writeback structure while the inode is still being dirtied under the inode spinlock.
Why it matters to the business
Local attackers can trigger kernel memory corruption leading to crashes or potential privilege escalation on affected Linux systems; high ecosystem prevalence means broad exposure across servers, containers, and embedded devices until kernels are updated.
How an attack unfolds
An attacker with local access triggers file writes that race with writeback structure switching; the race allows access to a freed wb structure, enabling memory corruption that can be leveraged for privilege escalation, similar to other recent kernel writeback and inode races exploited by container-focused threat actors.
How to fix it
Upgrade the Linux kernel to the fixed commit e2a14bbae5d8bacaa301362744a110e2be40a3a3 or later stable releases that contain the patch holding the inode spinlock until wb_wakeup_delayed() completes.
How to confirm the fix worked
Verify the running kernel contains commit e2a14bbae5d8bacaa301362744a110e2be40a3a3; confirm absence of the race by reviewing the __mark_inode_dirty and inode_switch_wbs_work_fn locking sequence in the source.
Typical attack path
- Obtain local code execution on a Linux system
- Trigger concurrent file modifications and writeback workqueue activity to hit the inode wb switch race
- Access the freed bdi_writeback via __mark_inode_dirty to cause use-after-free
- Corrupt kernel memory to escalate privileges or cause denial of service
How to detect it
Review kernel logs for oops or panic traces involving __mark_inode_dirty and inode_switch_wbs_work_fn; look for unusual systemd-random-seed or ext4 write activity preceding crashes on systems running vulnerable kernels.
What your security team should do
- Prioritize kernel updates on all systems within the next patch cycle due to local exploit potential
- Monitor for similar writeback and inode races in future kernel advisories
- Apply defense-in-depth with SELinux/AppArmor and container isolation to limit local attack surface
The record
In the Linux kernel, the following vulnerability has been resolved: fs: writeback: fix use-after-free in __mark_inode_dirty() An use-after-free issue occurred when __mark_inode_dirty() get the bdi_writeback that was in the progress of switching. CPU: 1 PID: 562 Comm: systemd-random- Not tainted 6.6.56-gb4403bd46a8e #1 ...... pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : __mark_inode_dirty+0x124/0x418 lr : __mark_inode_dirty+0x118/0x418 sp : ffffffc08c9dbbc0 ........ Call trace: __mark_inode_dirty+0x124/0x418 generic_update_time+0x4c/0x60 file_modified+0xcc/0xd0 ext4_buffered_write_iter+0x58/0x124 ext4_file_write_iter+0x54/0x704 vfs_write+0x1c0/0x308 ksys_write+0x74/0x10c __arm64_sys_write+0x1c/0x28 invoke_syscall+0x48/0x114 el0_svc_common.constprop.0+0xc0/0xe0 do_el0_svc+0x1c/0x28 el0_svc+0x40/0xe4 el0t_64_sync_handler+0x120/0x12c el0t_64_sync+0x194/0x198 Root cause is: systemd-random-seed kworker ---------------------------------------------------------------------- ___mark_inode_dirty inode_switch_wbs_work_fn spin_lock(&inode->i_lock); inode_attach_wb locked_inode_to_wb_and_lock_list get inode->i_wb spin_unlock(&inode->i_lock); spin_lock(&wb->list_lock) spin_lock(&inode->i_lock) inode_io_list_move_locked spin_unlock(&wb->list_lock) spin_unlock(&inode->i_lock) spin_lock(&old_wb->list_lock) inode_do_switch_wbs spin_lock(&inode->i_lock) inode->i_wb = new_wb spin_unlock(&inode->i_lock) spin_unlock(&old_wb->list_lock) wb_put_many(old_wb, nr_switched) cgwb_release old wb released wb_wakeup_delayed() accesses wb, then trigger the use-after-free issue Fix this race condition by holding inode spinlock until wb_wakeup_delayed() finished.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Debian:11 | linux | 0 | No fix |
| Debian:12 | linux | 0 | 6.1.153-1 |
| Debian:13 | linux | 0 | 6.12.48-1 |
| Debian:14 | linux | 0 | 6.16.6-1 |
| Linux | Kernel | 0 | 5.15.192 |
| Linux | Kernel | 4.2.0 | 5.10.247 |
| SUSE:Linux Enterprise High Availability Extension 15 SP6 | kernel-default | 0 | 6.4.0-150600.23.78.1 |
| SUSE:Linux Enterprise High Availability Extension 15 SP7 | kernel-default | 0 | 6.4.0-150700.53.22.1 |
| SUSE:Linux Enterprise Live Patching 15 SP6 | kernel-default | 0 | 6.4.0-150600.23.78.1 |
| SUSE:Linux Enterprise Live Patching 15 SP6 | kernel-livepatch-SLE15-SP6-RT_Update_17 | 0 | 1-150600.1.3.1 |
| SUSE:Linux Enterprise Live Patching 15 SP6 | kernel-livepatch-SLE15-SP6_Update_17 | 0 | 1-150600.13.5.1 |
| SUSE:Linux Enterprise Live Patching 15 SP7 | kernel-default | 0 | 6.4.0-150700.53.22.1 |
| SUSE:Linux Enterprise Live Patching 15 SP7 | kernel-livepatch-SLE15-SP7_Update_6 | 0 | 1-150700.15.3.1 |
| SUSE:Linux Enterprise Module for Basesystem 15 SP6 | kernel-64kb | 0 | 6.4.0-150600.23.78.1 |
| SUSE:Linux Enterprise Module for Basesystem 15 SP6 | kernel-default | 0 | 6.4.0-150600.23.78.1 |
| SUSE:Linux Enterprise Module for Basesystem 15 SP6 | kernel-default-base | 0 | 6.4.0-150600.23.78.1.150600.12.34.2 |
| SUSE:Linux Enterprise Module for Basesystem 15 SP6 | kernel-source | 0 | 6.4.0-150600.23.78.1 |
| SUSE:Linux Enterprise Module for Basesystem 15 SP6 | kernel-zfcpdump | 0 | 6.4.0-150600.23.78.1 |
| SUSE:Linux Enterprise Module for Basesystem 15 SP7 | kernel-64kb | 0 | 6.4.0-150700.53.22.1 |
| SUSE:Linux Enterprise Module for Basesystem 15 SP7 | kernel-default | 0 | 6.4.0-150700.53.22.1 |
| SUSE:Linux Enterprise Module for Basesystem 15 SP7 | kernel-default-base | 0 | 6.4.0-150700.53.22.1.150700.17.15.1 |
| SUSE:Linux Enterprise Module for Basesystem 15 SP7 | kernel-source | 0 | 6.4.0-150700.53.22.1 |
| SUSE:Linux Enterprise Module for Basesystem 15 SP7 | kernel-zfcpdump | 0 | 6.4.0-150700.53.22.1 |
| SUSE:Linux Enterprise Module for Development Tools 15 SP6 | kernel-docs | 0 | 6.4.0-150600.23.78.1 |
| SUSE:Linux Enterprise Module for Development Tools 15 SP6 | kernel-obs-build | 0 | 6.4.0-150600.23.78.1 |
| SUSE:Linux Enterprise Module for Development Tools 15 SP6 | kernel-source | 0 | 6.4.0-150600.23.78.1 |
| SUSE:Linux Enterprise Module for Development Tools 15 SP6 | kernel-syms | 0 | 6.4.0-150600.23.78.1 |
| SUSE:Linux Enterprise Module for Development Tools 15 SP7 | kernel-docs | 0 | 6.4.0-150700.53.22.1 |
| SUSE:Linux Enterprise Module for Development Tools 15 SP7 | kernel-obs-build | 0 | 6.4.0-150700.53.22.1 |
| SUSE:Linux Enterprise Module for Development Tools 15 SP7 | kernel-source | 0 | 6.4.0-150700.53.22.1 |
| SUSE:Linux Enterprise Module for Development Tools 15 SP7 | kernel-syms | 0 | 6.4.0-150700.53.22.1 |
| SUSE:Linux Enterprise Module for Legacy 15 SP6 | kernel-default | 0 | 6.4.0-150600.23.78.1 |
| SUSE:Linux Enterprise Module for Legacy 15 SP7 | kernel-default | 0 | 6.4.0-150700.53.22.1 |
| SUSE:Linux Enterprise Module for Public Cloud 15 SP6 | kernel-azure | 0 | 6.4.0-150600.8.55.1 |
| SUSE:Linux Enterprise Module for Public Cloud 15 SP6 | kernel-source-azure | 0 | 6.4.0-150600.8.55.1 |
| SUSE:Linux Enterprise Module for Public Cloud 15 SP6 | kernel-syms-azure | 0 | 6.4.0-150600.8.55.1 |
| SUSE:Linux Enterprise Module for Public Cloud 15 SP7 | kernel-azure | 0 | 6.4.0-150700.20.18.1 |
| SUSE:Linux Enterprise Module for Public Cloud 15 SP7 | kernel-source-azure | 0 | 6.4.0-150700.20.18.1 |
| SUSE:Linux Enterprise Module for Public Cloud 15 SP7 | kernel-syms-azure | 0 | 6.4.0-150700.20.18.1 |
| SUSE:Linux Enterprise Workstation Extension 15 SP6 | kernel-default | 0 | 6.4.0-150600.23.78.1 |
| SUSE:Linux Enterprise Workstation Extension 15 SP7 | kernel-default | 0 | 6.4.0-150700.53.22.1 |
| SUSE:Real Time Module 15 SP6 | kernel-rt | 0 | 6.4.0-150600.10.58.1 |
| SUSE:Real Time Module 15 SP6 | kernel-rt_debug | 0 | 6.4.0-150600.10.58.1 |
| SUSE:Real Time Module 15 SP6 | kernel-source-rt | 0 | 6.4.0-150600.10.58.1 |
| SUSE:Real Time Module 15 SP6 | kernel-syms-rt | 0 | 6.4.0-150600.10.58.1 |
| openSUSE:Leap 15.6 | dtb-aarch64 | 0 | 6.4.0-150600.23.78.1 |
| openSUSE:Leap 15.6 | kernel-64kb | 0 | 6.4.0-150600.23.78.1 |
| openSUSE:Leap 15.6 | kernel-azure | 0 | 6.4.0-150600.8.55.1 |
| openSUSE:Leap 15.6 | kernel-debug | 0 | 6.4.0-150600.23.78.1 |
| openSUSE:Leap 15.6 | kernel-default | 0 | 6.4.0-150600.23.78.1 |
| openSUSE:Leap 15.6 | kernel-default-base | 0 | 6.4.0-150600.23.78.1.150600.12.34.2 |
| openSUSE:Leap 15.6 | kernel-docs | 0 | 6.4.0-150600.23.78.1 |
| openSUSE:Leap 15.6 | kernel-kvmsmall | 0 | 6.4.0-150600.23.78.1 |
| openSUSE:Leap 15.6 | kernel-obs-build | 0 | 6.4.0-150600.23.78.1 |
| openSUSE:Leap 15.6 | kernel-obs-qa | 0 | 6.4.0-150600.23.78.1 |
| openSUSE:Leap 15.6 | kernel-rt | 0 | 6.4.0-150600.10.58.1 |
| openSUSE:Leap 15.6 | kernel-rt_debug | 0 | 6.4.0-150600.10.58.1 |
| openSUSE:Leap 15.6 | kernel-source | 0 | 6.4.0-150600.23.78.1 |
| openSUSE:Leap 15.6 | kernel-source-azure | 0 | 6.4.0-150600.8.55.1 |
| openSUSE:Leap 15.6 | kernel-source-rt | 0 | 6.4.0-150600.10.58.1 |
| openSUSE:Leap 15.6 | kernel-syms | 0 | 6.4.0-150600.23.78.1 |
| openSUSE:Leap 15.6 | kernel-syms-azure | 0 | 6.4.0-150600.8.55.1 |
| openSUSE:Leap 15.6 | kernel-syms-rt | 0 | 6.4.0-150600.10.58.1 |
| openSUSE:Leap 15.6 | kernel-zfcpdump | 0 | 6.4.0-150600.23.78.1 |
| openSUSE:Leap 16.0 | dtb-aarch64 | 0 | 6.12.0-160000.7.1 |
| openSUSE:Leap 16.0 | kernel-64kb | 0 | 6.12.0-160000.7.1 |
| openSUSE:Leap 16.0 | kernel-default | 0 | 6.12.0-160000.7.1 |
| openSUSE:Leap 16.0 | kernel-default-base | 0 | 6.12.0-160000.6.1.160000.2.4 |
| openSUSE:Leap 16.0 | kernel-docs | 0 | 6.12.0-160000.7.1 |
| openSUSE:Leap 16.0 | kernel-kvmsmall | 0 | 6.12.0-160000.7.1 |
| openSUSE:Leap 16.0 | kernel-obs-build | 0 | 6.12.0-160000.7.1 |
| openSUSE:Leap 16.0 | kernel-obs-qa | 0 | 6.12.0-160000.7.1 |
| openSUSE:Leap 16.0 | kernel-rt | 0 | 6.12.0-160000.7.1 |
| openSUSE:Leap 16.0 | kernel-source | 0 | 6.12.0-160000.7.1 |
| openSUSE:Leap 16.0 | kernel-syms | 0 | 6.12.0-160000.7.1 |
| openSUSE:Leap 16.0 | kernel-zfcpdump | 0 | 6.12.0-160000.7.1 |
Related vulnerabilities
- CVE-2025-39885 In the Linux kernel, the following vulnerability has been resolved: ocfs2: fix recursive… Also affects linux
- CVE-2025-39883 In the Linux kernel, the following vulnerability has been resolved: mm/memory-failure… Also affects linux
- CVE-2025-39876 In the Linux kernel, the following vulnerability has been resolved: net: fec: Fix… Also affects linux
- CVE-2025-39869 In the Linux kernel, the following vulnerability has been resolved: dmaengine: ti: edma… Also affects linux
- CVE-2025-39873 In the Linux kernel, the following vulnerability has been resolved: can: xilinx_can… Also affects linux
- CVE-2025-39863 In the Linux kernel, the following vulnerability has been resolved: wifi: brcmfmac: fix… Also affects linux
- CVE-2025-39865 In the Linux kernel, the following vulnerability has been resolved: tee: fix NULL pointer… Also affects linux
- CVE-2025-39864 In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: fix… Also affects linux