LiveActive security incident?Get immediate response
CVE Record

CVE-2025-39881: kernfs: Fix UAF in polling when open file is released

In the Linux kernel, the following vulnerability has been resolved: kernfs: Fix UAF in polling when open file is released A use-after-free (UAF) vulnerability was identified in the PSI (Pressure Stall Information) monitoring mechanism: BUG: KASAN: slab-use-after-free in psi_trigger_poll+0x3c/0x140 Read of size 8 at addr ffff3de3d50bd308 by task systemd/1 psi_trigger_poll+0x3c/0x140 cgroup_pressure_poll+0x70/0xa0 cgroup_file_poll+0x8c/0x100 kernfs_fop_poll+0x11c/0x1c0 ep_item_poll.isra.0+0x188/0x2c0 Allocated by task 1: cgroup_file_open+0x88/0x388 kernfs_fop_open+0x73c/0xaf0 do_dentry_open+0x5fc/0x1200 vfs_open+0xa0/0x3f0 do_open+0x7e8/0xd08 path_openat+0x2fc/0x6b0 do_filp_open+0x174/0x368 Freed by task 8462: cgroup_file_release+0x130/0x1f8 kernfs_drain_open_files+0x17c/0x440 kernfs_drain+0x2dc/0x360 kernfs_show+0x1b8/0x288 cgroup_file_show+0x150/0x268 cgroup_pressure_write+0x1dc/0x340 cgroup_file_write+0x274/0x548 Reproduction Steps: 1. Open test/cpu.pressure and establish epoll monitoring 2. Disable monitoring: echo 0 > test/cgroup.pressure 3. Re-enable monitoring: echo 1 > test/cgroup.pressure The race condition occurs because: 1. When cgroup.pressure is disabled (echo 0 > cgroup.pressure), it: - Releases PSI triggers via cgroup_file_release() - Frees of->priv through kernfs_drain_open_files() 2. While epoll still holds reference to the file and continues polling 3. Re-enabling (echo 1 > cgroup.pressure) accesses freed of->priv epolling disable/enable cgroup.pressure fd=open(cpu.pressure) while(1) ... epoll_wait kernfs_fop_poll kernfs_get_active = true echo 0 > cgroup.pressure ... cgroup_file_show kernfs_show // inactive kn kernfs_drain_open_files cft->release(of); kfree(ctx); ... kernfs_get_active = false echo 1 > cgroup.pressure kernfs_show kernfs_activate_one(kn); kernfs_fop_poll kernfs_get_active = true cgroup_file_poll psi_trigger_poll // UAF ... end: close(fd) To address this issue, introduce kernfs_get_active_of() for kernfs open files to obtain active references. This function will fail if the open file has been released. Replace kernfs_get_active() with kernfs_get_active_of() to prevent further operations on released file descriptors.

HighCVSS 7.8Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysishigh

Security readout for executives and security teams

Plain-English summary

CVE-2025-39881 is a Linux kernel use-after-free in cgroup Pressure Stall Information monitoring. A local, low-privileged user could trigger a race involving polling and pressure-monitor reconfiguration. The supplied CVSS score is 7.8, reflecting potential compromise of confidentiality, integrity, and availability, although the sources do not document proven real-world impact.

Executive priority

Patch promptly on shared Linux infrastructure and systems running untrusted workloads. Lower urgency is reasonable for isolated, single-purpose hosts without untrusted local access, but confirm exposure rather than relying solely on network controls. No active exploitation is established by the supplied evidence.

Technical view

An epoll reference can continue polling a cgroup pressure file after cgroup_file_release() frees its private context. Disabling and re-enabling cgroup.pressure can then make psi_trigger_poll() access freed memory. The fix introduces kernfs_get_active_of(), which refuses an active reference when the open file has already been released.

Likely exposure

Exposure is limited to affected Linux kernels with cgroups and PSI monitoring available, where an attacker already has local low-privileged access and sufficient cgroup pressure-file access. It is not described as remotely exploitable. The supplied affected-version data is ambiguous, so distribution-specific kernel status and backports must be checked.

Exploitation context

The supplied CVSS vector indicates local access, low complexity, low privileges, and no user interaction. The record is not in KEV, and the supplied sources provide no evidence of active exploitation or a public weaponized exploit. Reproduction and a kernel crash trace establish the underlying race, but not reliable privilege escalation.

Researcher notes

The vulnerable lifetime transition spans kernfs open-file draining, cgroup_file_release(), epoll-held file references, and later PSI polling. The fix changes reference acquisition from the kernfs node to the open-file-aware kernfs_get_active_of(). Exact vulnerable ranges and backport coverage cannot be reliably derived from the supplied version list alone.

Mitigation direction

  • Upgrade to a vendor-supported kernel containing the kernfs_get_active_of() fix.
  • Check Linux distribution advisories because vendors may backport fixes without changing upstream version numbers.
  • Restrict untrusted local access and unnecessary cgroup pressure-control permissions until patched.
  • Prioritize multi-user, shared-hosting, and container platforms where untrusted workloads can reach relevant cgroup files.

Validation and detection

  • Inventory running kernel versions across hosts and container worker nodes.
  • Confirm vendor advisories identify each installed kernel package as fixed or unaffected.
  • Verify the kernel source or vendor changelog includes the referenced kernfs active-open-file fix.
  • Review whether untrusted users or workloads can access PSI and cgroup pressure controls.
  • Monitor kernel logs for KASAN reports, use-after-free faults, or crashes involving psi_trigger_poll.
Prepared
Confidence
medium
Sources
8

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2025-39881 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
High
CVSS
7.8 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
3Timeline events
1ADP providers
7Source links

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
7.8CVSS 3.1HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9Linux

Vulnerability scoring details

Base CVSS 3.1 score

7.8High
CVSS 3.1 vector shape for CVE-2025-39881Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

ADP provider summaries

CVECVE Program Container

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux34f26a15611afb03c33df6819359d36f5b382589, 34f26a15611afb03c33df6819359d36f5b382589, 34f26a15611afb03c33df6819359d36f5b382589, 34f26a15611afb03c33df6819359d36f5b382589, 34f26a15611afb03c33df6819359d36f5b382589unaffected
LinuxLinux6.1, 0, 6.1.153, 6.6.107, 6.12.48, 6.16.8, 6.17affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.