Security readout for executives and security teams
Plain-English summary
A flaw in Linux process creation can take an incorrect cleanup path when futex allocation fails, attempting to unlock locks that were never acquired. A local, low-privileged user may be able to trigger serious kernel security effects. The supplied CVSS score is 7.8, but the source bundle provides no evidence of active exploitation.
Executive priority
Treat as a high-priority kernel update for exposed multi-user or shared-compute systems. It is not supported as an internet-remote or actively exploited emergency by this bundle. Accelerate patching where untrusted local access exists; otherwise handle through the next expedited kernel maintenance cycle after confirming vendor applicability.
Technical view
When futex_hash_allocate_default() fails inside copy_process(), execution incorrectly jumps to bad_fork_core_free. That label unlocks tasklist_lock and siglock although neither was acquired. The correction redirects failure handling to bad_fork_cancel_cgroup, where no sched_cgroup_fork() resources require release. The supplied vector indicates local access, low complexity, low privileges, no user interaction, and potentially high confidentiality, integrity, and availability impact.
Likely exposure
Exposure is limited to systems running affected Linux kernel versions where an authenticated local user can reach the vulnerable process-creation failure path. The bundle identifies Linux 6.16 through the listed 6.16.10/6.17 boundaries, but its compact version representation is ambiguous. Confirm exact affected and fixed releases with the kernel or distribution vendor.
Exploitation context
The CVSS vector describes a local, low-privilege attack requiring no user interaction. CISA KEV status is false, and the supplied sources do not report exploitation in the wild or provide evidence that exploitation is reliable. Triggering also depends on futex allocation failure during process creation, whose practical conditions are not established in the bundle.
Researcher notes
The defect is an erroneous error-path jump and lock-state mismatch in copy_process(), not a normal futex operation flaw. The bundle does not identify a CWE, concrete trigger conditions, crash signature, exploit primitive, or distribution-specific packages. Researchers should inspect the referenced commits and vendor backports when determining reachability and precise version boundaries.
Mitigation direction
- Check the Linux distribution's advisory for affected and fixed package versions.
- Upgrade to a vendor-supported kernel containing the referenced correction.
- Prioritize multi-user systems where untrusted users have local accounts or workload access.
- Apply normal kernel-update reboot procedures so the fixed kernel is actually running.
Validation and detection
- Record the running kernel version and distribution package release on each host.
- Compare versions against vendor advisories and the two referenced stable-kernel corrections.
- Confirm the post-reboot running kernel matches the installed fixed package.
- Review local-user and tenant access while remediation remains pending.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2025-39976 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9LinuxVulnerability scoring details
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/f1635765cd0fdbf27b04d9a50be91a01b5adda13CVE reference, Linux
- https://git.kernel.org/stable/c/4ec3c15462b9f44562f45723a92e2807746ba7d1CVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.