LiveActive security incident?Get immediate response
CVE Record

CVE-2025-39900: net_sched: gen_estimator: fix est_timer() vs CONFIG_PREEMPT_RT=y

In the Linux kernel, the following vulnerability has been resolved: net_sched: gen_estimator: fix est_timer() vs CONFIG_PREEMPT_RT=y syzbot reported a WARNING in est_timer() [1] Problem here is that with CONFIG_PREEMPT_RT=y, timer callbacks can be preempted. Adopt preempt_disable_nested()/preempt_enable_nested() to fix this. [1] WARNING: CPU: 0 PID: 16 at ./include/linux/seqlock.h:221 __seqprop_assert include/linux/seqlock.h:221 [inline] WARNING: CPU: 0 PID: 16 at ./include/linux/seqlock.h:221 est_timer+0x6dc/0x9f0 net/core/gen_estimator.c:93 Modules linked in: CPU: 0 UID: 0 PID: 16 Comm: ktimers/0 Not tainted syzkaller #0 PREEMPT_{RT,(full)} Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 RIP: 0010:__seqprop_assert include/linux/seqlock.h:221 [inline] RIP: 0010:est_timer+0x6dc/0x9f0 net/core/gen_estimator.c:93 Call Trace: <TASK> call_timer_fn+0x17e/0x5f0 kernel/time/timer.c:1747 expire_timers kernel/time/timer.c:1798 [inline] __run_timers kernel/time/timer.c:2372 [inline] __run_timer_base+0x648/0x970 kernel/time/timer.c:2384 run_timer_base kernel/time/timer.c:2393 [inline] run_timer_softirq+0xb7/0x180 kernel/time/timer.c:2403 handle_softirqs+0x22c/0x710 kernel/softirq.c:579 __do_softirq kernel/softirq.c:613 [inline] run_ktimerd+0xcf/0x190 kernel/softirq.c:1043 smpboot_thread_fn+0x53f/0xa60 kernel/smpboot.c:160 kthread+0x70e/0x8a0 kernel/kthread.c:463 ret_from_fork+0x3fc/0x770 arch/x86/kernel/process.c:148 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 </TASK>

MediumCVSS 5.5Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysismoderate

Security readout for executives and security teams

Plain-English summary

CVE-2025-39900 is a Linux kernel availability issue in the traffic control estimator path. On kernels built with CONFIG_PREEMPT_RT, a timer callback can be preempted in a way that triggers a kernel warning. The reported impact is local denial of service, not data theft or remote compromise.

Executive priority

Treat as a routine but time-bound kernel maintenance item. It is not presented as remotely exploitable or actively exploited, but availability impact can matter on shared or real-time Linux infrastructure. Patch through normal kernel update channels, prioritizing systems with local multi-user exposure.

Technical view

The flaw is in net/core/gen_estimator.c est_timer(). With CONFIG_PREEMPT_RT=y, timer callbacks can be preempted, violating seqlock expectations and causing a syzbot-reported WARNING. The upstream fix adopts preempt_disable_nested() and preempt_enable_nested(). CVSS is 5.5: local, low complexity, low privilege, no user interaction, high availability impact.

Likely exposure

Exposure appears limited to Linux systems running affected kernel versions or downstream builds, especially real-time kernels with CONFIG_PREEMPT_RT enabled and net scheduler estimator code reachable. The source bundle lists Linux 6.12, 6.12.46, 6.16.6, and 6.17 as affected entries, but distro backport status is not provided.

Exploitation context

The bundle shows no KEV listing and no cited evidence of active exploitation. The CVSS vector requires local low-privileged access. Impact is availability only, so risk is higher on shared hosts, CI runners, appliances, or real-time systems where local users or workloads are less trusted.

Researcher notes

Evidence is strongest for the root cause and upstream fix direction. The bundle does not include exploit details, distro package names, or complete fixed version ranges. Validate exposure through kernel configuration, vendor backport metadata, and whether the stable commits are present in the deployed kernel tree.

Mitigation direction

  • Apply a vendor kernel update containing the referenced stable fixes.
  • Prioritize systems using CONFIG_PREEMPT_RT or real-time kernel packages.
  • Check distribution advisories for backported fixes before assuming version safety.
  • Limit unnecessary local user and container access until patched.
  • Monitor Linux stable references for branch-specific correction status.

Validation and detection

  • Inventory running kernel versions across Linux hosts.
  • Check whether kernels are built with CONFIG_PREEMPT_RT enabled.
  • Compare installed kernels against vendor advisories and referenced stable commits.
  • Confirm patched hosts no longer match affected vendor package versions.
  • Review shared systems for untrusted local users or workloads.
Prepared
Confidence
medium
Sources
5

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2025-39900 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Medium
CVSS
5.5 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
3Timeline events
1ADP providers
4Source links

SSVC decision data

CISA-ADPCISA Coordinator
Timestamp
Version
2.0.3
Exploitation: noneAutomatable: noTechnical Impact: partial

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
5.5CVSS 3.1MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H1.83.6CISA-ADP

Vulnerability scoring details

Base CVSS 3.1 score

5.5Medium
CVSS 3.1 vector shape for CVE-2025-39900Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

ADP provider summaries

CISA-ADPCISA ADP Vulnrichment
cvssV3_1other:ssvc

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinuxd2d6422f8bd17c6bb205133e290625a564194496, d2d6422f8bd17c6bb205133e290625a564194496, d2d6422f8bd17c6bb205133e290625a564194496unaffected
LinuxLinux6.12, 0, 6.12.46, 6.16.6, 6.17affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.