LiveActive security incident?Get immediate response
CVE Record

CVE-2025-39866: fs: writeback: fix use-after-free in __mark_inode_dirty()

In the Linux kernel, the following vulnerability has been resolved: fs: writeback: fix use-after-free in __mark_inode_dirty() An use-after-free issue occurred when __mark_inode_dirty() get the bdi_writeback that was in the progress of switching. CPU: 1 PID: 562 Comm: systemd-random- Not tainted 6.6.56-gb4403bd46a8e #1 ...... pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : __mark_inode_dirty+0x124/0x418 lr : __mark_inode_dirty+0x118/0x418 sp : ffffffc08c9dbbc0 ........ Call trace: __mark_inode_dirty+0x124/0x418 generic_update_time+0x4c/0x60 file_modified+0xcc/0xd0 ext4_buffered_write_iter+0x58/0x124 ext4_file_write_iter+0x54/0x704 vfs_write+0x1c0/0x308 ksys_write+0x74/0x10c __arm64_sys_write+0x1c/0x28 invoke_syscall+0x48/0x114 el0_svc_common.constprop.0+0xc0/0xe0 do_el0_svc+0x1c/0x28 el0_svc+0x40/0xe4 el0t_64_sync_handler+0x120/0x12c el0t_64_sync+0x194/0x198 Root cause is: systemd-random-seed kworker ---------------------------------------------------------------------- ___mark_inode_dirty inode_switch_wbs_work_fn spin_lock(&inode->i_lock); inode_attach_wb locked_inode_to_wb_and_lock_list get inode->i_wb spin_unlock(&inode->i_lock); spin_lock(&wb->list_lock) spin_lock(&inode->i_lock) inode_io_list_move_locked spin_unlock(&wb->list_lock) spin_unlock(&inode->i_lock) spin_lock(&old_wb->list_lock) inode_do_switch_wbs spin_lock(&inode->i_lock) inode->i_wb = new_wb spin_unlock(&inode->i_lock) spin_unlock(&old_wb->list_lock) wb_put_many(old_wb, nr_switched) cgwb_release old wb released wb_wakeup_delayed() accesses wb, then trigger the use-after-free issue Fix this race condition by holding inode spinlock until wb_wakeup_delayed() finished.

HighCVSS 7.8Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysishigh

Security readout for executives and security teams

Plain-English summary

A Linux kernel race can access a writeback object after it has been freed. The observed failure occurred during a normal file write and can crash the kernel. The supplied CVSS score is 7.8 because a low-privileged local actor may affect confidentiality, integrity, and availability, although the sources do not demonstrate successful exploitation.

Executive priority

Treat this as an expedited Linux patching item, especially for shared or multi-tenant systems. The potential impact is high, but urgency is moderated by the local-access requirement and lack of cited active exploitation. Use vendor package guidance rather than interpreting upstream version numbers alone.

Technical view

__mark_inode_dirty() can retain an inode’s old bdi_writeback while inode_switch_wbs_work_fn changes and releases it. A subsequent wb_wakeup_delayed() call accesses the freed object. The kernel fix keeps the inode spinlock held until the wakeup finishes, closing the race. The supplied trace involved ext4 writes on arm64 Linux 6.6.56.

Likely exposure

Exposure is limited to affected Linux kernels and requires local, low-privileged access according to the CVSS vector. Shared Linux hosts and systems running untrusted local workloads deserve particular attention. The bundled version data is insufficiently structured to determine every vulnerable distribution package; vendor backports may also change exposure.

Exploitation context

The source bundle marks this CVE as absent from CISA KEV and provides no evidence of active exploitation, public exploit code, or reliable privilege escalation. It documents a reproducible kernel use-after-free and crash trace. Internet reachability alone does not create a remote attack path because the supplied vector is AV:L.

Researcher notes

The race crosses inode writeback reassignment: the old writeback structure can be released after inode->i_wb changes but before wb_wakeup_delayed() finishes using it. The sources provide multiple stable-branch fixes. They provide no CWE classification, exploitability analysis, or proof that controlled code execution is achievable rather than a crash.

Mitigation direction

  • Install a vendor-supported kernel update containing the applicable stable fix or backport.
  • Reboot affected systems into the updated kernel following normal change-control procedures.
  • Prioritize shared hosts and systems permitting untrusted or low-privileged local workloads.
  • Until updated, reduce unnecessary local access and follow distribution-specific vendor guidance.

Validation and detection

  • Inventory installed and running kernel versions across Linux systems.
  • Check each distribution or appliance advisory for its exact affected and fixed package versions.
  • Confirm the running kernel contains the applicable stable fix or vendor backport.
  • Review kernel logs for faults involving __mark_inode_dirty or related use-after-free reports.
  • Verify systems booted the updated kernel after remediation; installation alone is insufficient.
Prepared
Confidence
medium
Sources
10

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2025-39866 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
High
CVSS
7.8 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
3Timeline events
2ADP providers
12Source links

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
7.8CVSS 3.1HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9Linux

Vulnerability scoring details

Base CVSS 3.1 score

7.8High
CVSS 3.1 vector shape for CVE-2025-39866Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

ADP provider summaries

CVECVE Program Container
siemens-SADPADP container

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux0747259d13febfcc838980a63c414c9b920cea6f, 0747259d13febfcc838980a63c414c9b920cea6f, 0747259d13febfcc838980a63c414c9b920cea6f, 0747259d13febfcc838980a63c414c9b920cea6f, 0747259d13febfcc838980a63c414c9b920cea6f, 0747259d13febfcc838980a63c414c9b920cea6f, 0747259d13febfcc838980a63c414c9b920cea6funaffected
LinuxLinux4.2, 0, 5.10.247, 5.15.192, 6.1.151, 6.6.105, 6.12.46, 6.16.6, 6.17affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.