CVE-2025-39909

What it actually does

Divide-by-zero in damon_lru_sort_apply_parameters due to improper input validation on parameters supplied to DAMON LRU sorting logic, leading to undefined kernel behavior or panic.

Why it matters to the business

Potential denial-of-service crashes on affected Linux systems with low urgency given no known exploitation, ransomware use, or high EPSS; downstream kernel dependents increase exposure surface across SUSE and container-optimized environments.

How an attack unfolds

An attacker supplies crafted DAMON LRU sort parameters that result in a zero denominator during apply_parameters; listed threat actors VMSCAPE and related container privilege-escalation campaigns may combine this with other kernel flaws such as CVE-2025-39946 for escalation on Container-Optimized OS.

How to fix it

Apply the listed fixed versions immediately: openssl packages on all SUSE products to 1.0.2j-60.30.1 and kernel trees to commit 74e391f7da7d9d5235a3cca88ee9fc18f720c75b; prioritize systems matching the 391-day-old publication window.

How to confirm the fix worked

Confirm kernel source contains the divide-by-zero guard in damon_lru_sort_apply_parameters; verify package versions match the exact SUSE and git fixed revisions; re-test DAMON LRU sort with boundary parameter values.

Typical attack path

1. Gain access to a process or container that can influence DAMON LRU sort parameters
2. Trigger damon_lru_sort_apply_parameters with values producing zero divisor
3. Cause kernel panic or instability to achieve denial of service or combine with other primitives for privilege escalation

How to detect it

Search kernel logs and audit trails for damon_lru_sort_apply_parameters calls or divide-by-zero faults; correlate with container runtime activity on systems also affected by the listed threat-actor CVEs.

What your security team should do

• Patch all listed SUSE openssl and kernel packages to the specified fixed versions within CISA-style timelines even though KEV is false
• Audit container-optimized OS fleets for the related privilege-escalation CVEs mentioned alongside VMSCAPE
• Monitor EPSS trend and re-evaluate if score rises above 0.01