CVE-2025-39900

What it actually does

Race condition between est_timer() and concurrent operations in the generic network estimator when CONFIG_PREEMPT_RT is enabled, allowing timer list corruption or use-after-free in the kernel networking stack.

Why it matters to the business

Kernel instability or crashes during network traffic processing on affected Linux systems can cause denial of service for network-dependent services; widespread use in enterprise servers increases operational risk until patched, especially on long-lived distributions.

How an attack unfolds

An attacker sends crafted network traffic that triggers the estimator timer while preemption occurs under RT kernel configuration, racing the timer callback against concurrent estimator updates to corrupt kernel data structures and potentially escalate privileges or crash the system.

How to fix it

Upgrade affected packages to the listed fixed versions: kernel-bigsmp, kernel-default, kernel-ec2, kernel-pae, kernel-source, kernel-syms, kernel-trace, and kernel-xen on SUSE Linux Enterprise Server 11 SP3-LTSS and Point of Sale 11 SP3 to 3.0.101-0.47.106.35.1; apply the GIT commit a22ec2ee824be30803068a52f78f7ffe3bc879fb in stable trees.

How to confirm the fix worked

Confirm kernel version matches or exceeds the fixed releases; verify CONFIG_PREEMPT_RT is either disabled or the patched estimator code is present; run regression tests exercising network rate estimators under load with preemption enabled.

Typical attack path

1. Identify systems running vulnerable kernel versions with CONFIG_PREEMPT_RT enabled
2. Send network packets that activate the generic rate estimator
3. Trigger preemption during est_timer execution to win the race
4. Exploit resulting memory corruption for privilege escalation or denial of service

How to detect it

Review kernel logs for timer-related warnings or crashes in net_sched/gen_estimator; inspect for unexpected network estimator state changes; correlate with traffic patterns that exercise rate estimators on RT kernels.

What your security team should do

• Prioritize patching all listed SUSE 11 SP3 kernels within maintenance windows due to 391 days since disclosure
• Audit environments for CONFIG_PREEMPT_RT usage and disable where feasible until upgraded
• Monitor for related privilege-escalation activity reported against similar kernel timer issues
• Apply updates to the exact per-package versions provided for each affected SUSE product