CVE-2025-39895

What it actually does

The flaw is an improper input validation in sched_numa_find_nth_cpu() that does not correctly handle offline NUMA masks, allowing selection of invalid CPUs and potential kernel instability or incorrect scheduling decisions.

Why it matters to the business

Unpatched systems face elevated risk of kernel crashes, degraded performance on NUMA hardware, and possible local privilege escalation, increasing downtime and operational costs especially on older enterprise Linux deployments with high downstream package usage.

How an attack unfolds

An attacker with local access crafts or triggers workloads that invoke sched_numa_find_nth_cpu() while relevant NUMA masks are offline, bypassing validation to induce invalid CPU selection that can be chained with other kernel primitives for privilege escalation, as seen in related container-optimized OS campaigns.

How to fix it

Upgrade affected SUSE packages to version 3.0.101-108.57.1 or later; apply Linux kernel commit f9b8d4dba8e78c1887fecd81ba0d8204d6ff05fc from the stable git tree; reboot after installation.

How to confirm the fix worked

Confirm kernel version string contains 3.0.101-108.57.1 or the listed git commit hash; run sched_numa_find_nth_cpu() test cases with offline masks to verify no invalid CPU is returned.

Typical attack path

1. Obtain local code execution on target system
2. Force or wait for NUMA mask offline state
3. Invoke scheduler paths calling sched_numa_find_nth_cpu() with crafted input
4. Exploit resulting invalid CPU selection for memory corruption or information leak
5. Escalate to root or container breakout

How to detect it

Review kernel logs for scheduler-related warnings or panics involving NUMA masks; inspect audit logs for unexpected process CPU affinity changes; correlate with local exploit attempts in container environments.

What your security team should do

• Prioritize patching all SUSE Linux Enterprise Server 11 SP4 and related kernel packages within the next maintenance window due to 391 days of exposure
• Restrict untrusted local code execution on NUMA systems until updated
• Monitor for related Linux kernel privilege escalation activity from known container-optimized OS campaigns