Linux: Use After Free
CVE-2025-39824 is a high-severity use after free vulnerability in Linux, with a CVSS 3.1 base score of 7.8 out of 10. It can be exploited with local access to the system by an attacker with a low-privileged account, without any action from a user. The record lists versions 9a9e4a8317437bf944fa017c66e1e23a0368b5c7, 7170122e2ae4ab378c9cdf7cc54dea8b0abbbca5, eaae728e7335b5dbad70966e2bd520a731fdf7b2 as the first without the flaw, so updating Linux to one of those releases or later removes the exposure. There is no confirmed exploitation so far. EPSS estimates a 0.17% chance of exploitation within 30 days, which is low compared with other CVEs.
High severity with no evidence of exploitation so far.
What to do
- Update Linux to 9a9e4a8317437bf944fa017c66e1e23a0368b5c7 or 7170122e2ae4ab378c9cdf7cc54dea8b0abbbca5 or eaae728e7335b5dbad70966e2bd520a731fdf7b2 or a8ca8fe7f516d27ece3afb995c3bd4d07dcbe62c, whichever matches your release line, or a later version.
- Update SIMATIC CN 4100 to V5.0 or a later version.
- Update Linux Kernel to 5.4.298 or 5.10.242 or 5.15.191 or 6.1.150, whichever matches your release line, or a later version.
Affected products and versions
| Vendor | Product | Affected versions | Fixed in |
|---|---|---|---|
| Linux | Linux | 9ce12d8be12c94334634dd57050444910415e45f up to, but not including, 9a9e4a8317437bf944fa017c66e1e23a0368b5c7; 9ce12d8be12c94334634dd57050444910415e45f up to, but not including, 7170122e2ae4ab378c9cdf7cc54dea8b0abbbca5; 9ce12d8be12c94334634dd57050444910415e45f up to, but not including, eaae728e7335b5dbad70966e2bd520a731fdf7b2; 9ce12d8be12c94334634dd57050444910415e45f up to, but not including, a8ca8fe7f516d27ece3afb995c3bd4d07dcbe62c; 9ce12d8be12c94334634dd57050444910415e45f up to, but not including, 5f3c0839b173f7f33415eb098331879e547d1d2d; 9ce12d8be12c94334634dd57050444910415e45f up to, but not including, c0d77e3441a92d0b4958193c9ac1c3f81c6f1d1c; 9ce12d8be12c94334634dd57050444910415e45f up to, but not including, 72a4ec018c9e9bc52f4f80eb3afb5d6a6b752275; 9ce12d8be12c94334634dd57050444910415e45f up to, but not including, d3af6ca9a8c34bbd8cff32b469b84c9021c9e7e4; and 1 more ranges | 9a9e4a8317437bf944fa017c66e1e23a0368b5c7, 7170122e2ae4ab378c9cdf7cc54dea8b0abbbca5, eaae728e7335b5dbad70966e2bd520a731fdf7b2, a8ca8fe7f516d27ece3afb995c3bd4d07dcbe62c, 5f3c0839b173f7f33415eb098331879e547d1d2d, c0d77e3441a92d0b4958193c9ac1c3f81c6f1d1c |
| Siemens | SIMATIC CN 4100 | before V5.0 | V5.0 |
| Linux | Linux Kernel | 4.10 up to, but not including, 5.4.298; 5.5 up to, but not including, 5.10.242; 5.11 up to, but not including, 5.15.191; 5.16 up to, but not including, 6.1.150; 6.2 up to, but not including, 6.6.104; 6.7 up to, but not including, 6.12.45; 6.13 up to, but not including, 6.16.5; 6.17 | 5.4.298, 5.10.242, 5.15.191, 6.1.150, 6.6.104, 6.12.45 |
| Debian | Debian Linux | 11.0 | Not stated |
Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.
How the severity score breaks down
- Attack vector
- LocalThe attacker needs local access or must trick a user into running something.
- Attack complexity
- LowNo special conditions are needed; the attack works reliably.
- Privileges required
- LowA basic user account is enough.
- User interaction
- NoneNo action by a victim is required.
- Scope
- UnchangedImpact stays within the vulnerable component.
- Confidentiality
- HighAll data handled by the component can be read.
- Integrity
- HighData or code can be modified at will.
- Availability
- HighThe component can be taken down completely.
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. Scored by NVD.
Official description
In the Linux kernel, the following vulnerability has been resolved: HID: asus: fix UAF via HID_CLAIMED_INPUT validation After hid_hw_start() is called hidinput_connect() will eventually be called to set up the device with the input layer since the HID_CONNECT_DEFAULT connect mask is used. During hidinput_connect() all input and output reports are processed and corresponding hid_inputs are allocated and configured via hidinput_configure_usages(). This process involves slot tagging report fields and configuring usages by setting relevant bits in the capability bitmaps. However it is possible that the capability bitmaps are not set at all leading to the subsequent hidinput_has_been_populated() check to fail leading to the freeing of the hid_input and the underlying input device. This becomes problematic because a malicious HID device like a ASUS ROG N-Key keyboard can trigger the above scenario via a specially crafted descriptor which then leads to a user-after-free when the name of the freed input device is written to later on after hid_hw_start(). Below, report 93 intentionally utilises the HID_UP_UNDEFINED Usage Page which is skipped during usage configuration, leading to the frees. 0x05, 0x0D, // Usage Page (Digitizer) 0x09, 0x05, // Usage (Touch Pad) 0xA1, 0x01, // Collection (Application) 0x85, 0x0D, // Report ID (13) 0x06, 0x00, 0xFF, // Usage Page (Vendor Defined 0xFF00) 0x09, 0xC5, // Usage (0xC5) 0x15, 0x00, // Logical Minimum (0) 0x26, 0xFF, 0x00, // Logical Maximum (255) 0x75, 0x08, // Report Size (8) 0x95, 0x04, // Report Count (4) 0xB1, 0x02, // Feature (Data,Var,Abs) 0x85, 0x5D, // Report ID (93) 0x06, 0x00, 0x00, // Usage Page (Undefined) 0x09, 0x01, // Usage (0x01) 0x15, 0x00, // Logical Minimum (0) 0x26, 0xFF, 0x00, // Logical Maximum (255) 0x75, 0x08, // Report Size (8) 0x95, 0x1B, // Report Count (27) 0x81, 0x02, // Input (Data,Var,Abs) 0xC0, // End Collection Below is the KASAN splat after triggering the UAF: [ 21.672709] ================================================================== [ 21.673700] BUG: KASAN: slab-use-after-free in asus_probe+0xeeb/0xf80 [ 21.673700] Write of size 8 at addr ffff88810a0ac000 by task kworker/1:2/54 [ 21.673700] [ 21.673700] CPU: 1 UID: 0 PID: 54 Comm: kworker/1:2 Not tainted 6.16.0-rc4-g9773391cf4dd-dirty #36 PREEMPT(voluntary) [ 21.673700] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.2-debian-1.16.2-1 04/01/2014 [ 21.673700] Call Trace: [ 21.673700] <TASK> [ 21.673700] dump_stack_lvl+0x5f/0x80 [ 21.673700] print_report+0xd1/0x660 [ 21.673700] kasan_report+0xe5/0x120 [ 21.673700] __asan_report_store8_noabort+0x1b/0x30 [ 21.673700] asus_probe+0xeeb/0xf80 [ 21.673700] hid_device_probe+0x2ee/0x700 [ 21.673700] really_probe+0x1c6/0x6b0 [ 21.673700] __driver_probe_device+0x24f/0x310 [ 21.673700] driver_probe_device+0x4e/0x220 [...] [ 21.673700] [ 21.673700] Allocated by task 54: [ 21.673700] kasan_save_stack+0x3d/0x60 [ 21.673700] kasan_save_track+0x18/0x40 [ 21.673700] kasan_save_alloc_info+0x3b/0x50 [ 21.673700] __kasan_kmalloc+0x9c/0xa0 [ 21.673700] __kmalloc_cache_noprof+0x139/0x340 [ 21.673700] input_allocate_device+0x44/0x370 [ 21.673700] hidinput_connect+0xcb6/0x2630 [ 21.673700] hid_connect+0xf74/0x1d60 [ 21.673700] hid_hw_start+0x8c/0x110 [ 21.673700] asus_probe+0x5a3/0xf80 [ 21.673700] hid_device_probe+0x2ee/0x700 [ 21.673700] really_probe+0x1c6/0x6b0 [ 21.673700] __driver_probe_device+0x24f/0x310 [ 21.673700] driver_probe_device+0x4e/0x220 [...] [ 21.673700] [ 21.673700] Freed by task 54: [ 21.673700] kasan_save_stack+0x3d/0x60 [ 21.673700] kasan_save_track+0x18/0x40 [ 21.673700] kasan_save_free_info+0x3f/0x60 [ 21.673700] __kasan_slab_free+0x3c/0x50 [ 21.673700] kfre ---truncated---
Source: the CVE record as published by its numbering authority, via NVD and CVE.org.
The underlying weakness: Use After Free
The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory belongs to the code that operates on the new pointer.
How developers prevent this class of flaw
- Choose a language that provides automatic memory management.
- When freeing pointers, be sure to set them to NULL once they are freed. However, the utilization of multiple or complex data structures may lower the usefulness of this strategy.
Timeline
- CVE record published.
- CISA published its SSVC assessment (exploitation: none, automatable: no, technical impact: partial).
- Record last changed materially (score, affected products, status or references).
References
Patches and release notes
- git.kernel.org/stable/c/5f3c0839b173f7f33415eb098331879e547d1d2d
- git.kernel.org/stable/c/7170122e2ae4ab378c9cdf7cc54dea8b0abbbca5
- git.kernel.org/stable/c/72a4ec018c9e9bc52f4f80eb3afb5d6a6b752275
- git.kernel.org/stable/c/9a9e4a8317437bf944fa017c66e1e23a0368b5c7
- git.kernel.org/stable/c/a8ca8fe7f516d27ece3afb995c3bd4d07dcbe62c
- git.kernel.org/stable/c/c0d77e3441a92d0b4958193c9ac1c3f81c6f1d1c
- git.kernel.org/stable/c/d3af6ca9a8c34bbd8cff32b469b84c9021c9e7e4
- git.kernel.org/stable/c/eaae728e7335b5dbad70966e2bd520a731fdf7b2
Third-party and government advisories
- lists.debian.org/debian-lts-announce/2025/10/msg00007.htmlMailing List, Third Party Advisory
- lists.debian.org/debian-lts-announce/2025/10/msg00008.htmlMailing List, Third Party Advisory
Other references
Recent Use After Free vulnerabilities
- 7.8 High severity
- 7.8 High severity
- 7.8 High severity
- 7.8 High severity
- 7.8 High severity
- 7.0 High severity
Spotted an error? Tell us.