Linux: Use After Free
CVE-2025-39691 is a high-severity use after free vulnerability in Linux, with a CVSS 3.1 base score of 7.8 out of 10. It can be exploited with local access to the system by an attacker with a low-privileged account, without any action from a user. The record lists versions 70a09115da586bf662c3bae9c0c4a1b99251fad9, 3169edb8945c295cf89120fc6b2c35cfe3ad4c9e, 03b40bf5d0389ca23ae6857ee25789f0e0b47ce8 as the first without the flaw, so updating Linux to one of those releases or later removes the exposure. There is no confirmed exploitation so far. EPSS estimates a 0.19% chance of exploitation within 30 days, which is low compared with other CVEs.
High severity with no evidence of exploitation so far.
What to do
- Update Linux to 70a09115da586bf662c3bae9c0c4a1b99251fad9 or 3169edb8945c295cf89120fc6b2c35cfe3ad4c9e or 03b40bf5d0389ca23ae6857ee25789f0e0b47ce8 or c58c6b532b7b69537cfd9ef701c7e37cdcf79dc4, whichever matches your release line, or a later version.
- Update SIMATIC CN 4100 to V5.0 or a later version.
- Update Linux Kernel to 5.4.297 or 5.10.241 or 5.15.190 or 6.1.149, whichever matches your release line, or a later version.
Affected products and versions
| Vendor | Product | Affected versions | Fixed in |
|---|---|---|---|
| Linux | Linux | 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 up to, but not including, 70a09115da586bf662c3bae9c0c4a1b99251fad9; 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 up to, but not including, 3169edb8945c295cf89120fc6b2c35cfe3ad4c9e; 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 up to, but not including, 03b40bf5d0389ca23ae6857ee25789f0e0b47ce8; 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 up to, but not including, c58c6b532b7b69537cfd9ef701c7e37cdcf79dc4; 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 up to, but not including, c5aa6ba1127307ab5dc3773eaf40d73a3423841f; 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 up to, but not including, 042cf48ecf67f72c8b3846c7fac678f472712ff3; 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 up to, but not including, 90b5193edb323fefbee0e4e5bc39ed89dcc37719; 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 up to, but not including, 7375f22495e7cd1c5b3b5af9dcc4f6dffe34ce49; and 1 more ranges | 70a09115da586bf662c3bae9c0c4a1b99251fad9, 3169edb8945c295cf89120fc6b2c35cfe3ad4c9e, 03b40bf5d0389ca23ae6857ee25789f0e0b47ce8, c58c6b532b7b69537cfd9ef701c7e37cdcf79dc4, c5aa6ba1127307ab5dc3773eaf40d73a3423841f, 042cf48ecf67f72c8b3846c7fac678f472712ff3 |
| Siemens | SIMATIC CN 4100 | before V5.0 | V5.0 |
| Siemens | SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0) | V3.1.6 and later; V3.1.7 and later | Not stated |
| Siemens | SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0) | V3.1.6 and later; V3.1.7 and later | Not stated |
| Siemens | SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0) | V3.1.6 and later; V3.1.7 and later | Not stated |
| Siemens | SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0) | V3.1.6 and later; V3.1.7 and later | Not stated |
| Siemens | SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0) | V3.1.6 and later; V3.1.7 and later | Not stated |
| Linux | Linux Kernel | 2.6.13 up to, but not including, 5.4.297; 5.5 up to, but not including, 5.10.241; 5.11 up to, but not including, 5.15.190; 5.16 up to, but not including, 6.1.149; 6.2 up to, but not including, 6.6.103; 6.7 up to, but not including, 6.12.44; 6.13 up to, but not including, 6.16.4; 2.6.12; and 1 more ranges | 5.4.297, 5.10.241, 5.15.190, 6.1.149, 6.6.103, 6.12.44 |
| Debian | Debian Linux | 11.0 | Not stated |
Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.
How the severity score breaks down
- Attack vector
- LocalThe attacker needs local access or must trick a user into running something.
- Attack complexity
- LowNo special conditions are needed; the attack works reliably.
- Privileges required
- LowA basic user account is enough.
- User interaction
- NoneNo action by a victim is required.
- Scope
- UnchangedImpact stays within the vulnerable component.
- Confidentiality
- HighAll data handled by the component can be read.
- Integrity
- HighData or code can be modified at will.
- Availability
- HighThe component can be taken down completely.
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. Scored by NVD.
| Scoring system | Score | Severity | Scored by |
|---|---|---|---|
| CVSS 3.1 | 7.8 | High | CNA |
| CVSS 3.1 | 7.8 | High | NVD |
Official description
In the Linux kernel, the following vulnerability has been resolved: fs/buffer: fix use-after-free when call bh_read() helper There's issue as follows: BUG: KASAN: stack-out-of-bounds in end_buffer_read_sync+0xe3/0x110 Read of size 8 at addr ffffc9000168f7f8 by task swapper/3/0 CPU: 3 UID: 0 PID: 0 Comm: swapper/3 Not tainted 6.16.0-862.14.0.6.x86_64 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996) Call Trace: <IRQ> dump_stack_lvl+0x55/0x70 print_address_description.constprop.0+0x2c/0x390 print_report+0xb4/0x270 kasan_report+0xb8/0xf0 end_buffer_read_sync+0xe3/0x110 end_bio_bh_io_sync+0x56/0x80 blk_update_request+0x30a/0x720 scsi_end_request+0x51/0x2b0 scsi_io_completion+0xe3/0x480 ? scsi_device_unbusy+0x11e/0x160 blk_complete_reqs+0x7b/0x90 handle_softirqs+0xef/0x370 irq_exit_rcu+0xa5/0xd0 sysvec_apic_timer_interrupt+0x6e/0x90 </IRQ> Above issue happens when do ntfs3 filesystem mount, issue may happens as follows: mount IRQ ntfs_fill_super read_cache_page do_read_cache_folio filemap_read_folio mpage_read_folio do_mpage_readpage ntfs_get_block_vbo bh_read submit_bh wait_on_buffer(bh); blk_complete_reqs scsi_io_completion scsi_end_request blk_update_request end_bio_bh_io_sync end_buffer_read_sync __end_buffer_read_notouch unlock_buffer wait_on_buffer(bh);--> return will return to caller put_bh --> trigger stack-out-of-bounds In the mpage_read_folio() function, the stack variable 'map_bh' is passed to ntfs_get_block_vbo(). Once unlock_buffer() unlocks and wait_on_buffer() returns to continue processing, the stack variable is likely to be reclaimed. Consequently, during the end_buffer_read_sync() process, calling put_bh() may result in stack overrun. If the bh is not allocated on the stack, it belongs to a folio. Freeing a buffer head which belongs to a folio is done by drop_buffers() which will fail to free buffers which are still locked. So it is safe to call put_bh() before __end_buffer_read_notouch().
Source: the CVE record as published by its numbering authority, via NVD and CVE.org.
The underlying weakness: Use After Free
The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory belongs to the code that operates on the new pointer.
How developers prevent this class of flaw
- Choose a language that provides automatic memory management.
- When freeing pointers, be sure to set them to NULL once they are freed. However, the utilization of multiple or complex data structures may lower the usefulness of this strategy.
Timeline
- CVE record published.
- CISA published its SSVC assessment (exploitation: none, automatable: no, technical impact: total).
- Record last changed materially (score, affected products, status or references).
References
Patches and release notes
- git.kernel.org/stable/c/03b40bf5d0389ca23ae6857ee25789f0e0b47ce8
- git.kernel.org/stable/c/042cf48ecf67f72c8b3846c7fac678f472712ff3
- git.kernel.org/stable/c/3169edb8945c295cf89120fc6b2c35cfe3ad4c9e
- git.kernel.org/stable/c/70a09115da586bf662c3bae9c0c4a1b99251fad9
- git.kernel.org/stable/c/7375f22495e7cd1c5b3b5af9dcc4f6dffe34ce49
- git.kernel.org/stable/c/90b5193edb323fefbee0e4e5bc39ed89dcc37719
- git.kernel.org/stable/c/c58c6b532b7b69537cfd9ef701c7e37cdcf79dc4
- git.kernel.org/stable/c/c5aa6ba1127307ab5dc3773eaf40d73a3423841f
Third-party and government advisories
- lists.debian.org/debian-lts-announce/2025/10/msg00007.htmlMailing List, Third Party Advisory
- lists.debian.org/debian-lts-announce/2025/10/msg00008.htmlMailing List, Third Party Advisory
Other references
Recent Use After Free vulnerabilities
- 7.8 High severity
- 7.8 High severity
- 7.8 High severity
- 7.8 High severity
- 8.8 High severity
Android Runtime Use-After-Free Exploited
- 8.0 High severity
Spotted an error? Tell us.