Linux: Use After Free
CVE-2025-39860 is a high-severity use after free vulnerability in Linux, with a CVSS 3.1 base score of 7.8 out of 10. It can be exploited with local access to the system by an attacker with a low-privileged account, without any action from a user. The record lists versions 964cbb198f9c46c2b2358cd1faffc04c1e8248cf, 83e1d9892ef51785cf0760b7681436760dda435a, 47f6090bcf75c369695d21c3f179db8a56bbbd49 as the first without the flaw, so updating Linux to one of those releases or later removes the exposure. There is no confirmed exploitation so far. EPSS estimates a 0.23% chance of exploitation within 30 days, which is low compared with other CVEs.
High severity with no evidence of exploitation so far.
What to do
- Update Linux to 964cbb198f9c46c2b2358cd1faffc04c1e8248cf or 83e1d9892ef51785cf0760b7681436760dda435a or 47f6090bcf75c369695d21c3f179db8a56bbbd49 or 2ca99fc3512a8074de20ee52a87b492dfcc41a4d, whichever matches your release line, or a later version.
- Update RUGGEDCOM RST2428P to V3.3 or a later version.
- Update SCALANCE XC-300/XR-300/XC-400/XR-500WG/XR-500 family to V3.3 or a later version.
Affected products and versions
| Vendor | Product | Affected versions | Fixed in |
|---|---|---|---|
| Linux | Linux | a2da00d1ea1abfb04f846638e210b5b5166e3c9c up to, but not including, 964cbb198f9c46c2b2358cd1faffc04c1e8248cf; 06f87c96216bc5cd1094c23492274f77f1d5dd3b up to, but not including, 83e1d9892ef51785cf0760b7681436760dda435a; fbe5a2fed8156cc19eb3b956602b0a1dd46a302d up to, but not including, 47f6090bcf75c369695d21c3f179db8a56bbbd49; 29fac18499332211b2615ade356e2bd8b3269f98 up to, but not including, 2ca99fc3512a8074de20ee52a87b492dfcc41a4d; 1728137b33c00d5a2b5110ed7aafb42e7c32e4a1 up to, but not including, 6077d16b5c0f65d571eee709de2f0541fb5ef0ca; 1728137b33c00d5a2b5110ed7aafb42e7c32e4a1 up to, but not including, 306b0991413b482dbf5585b423022123bb505966; 1728137b33c00d5a2b5110ed7aafb42e7c32e4a1 up to, but not including, 3dff390f55ccd9ce12e91233849769b5312180c2; 1728137b33c00d5a2b5110ed7aafb42e7c32e4a1 up to, but not including, 862c628108562d8c7a516a900034823b381d3cba; and 11 more ranges | 964cbb198f9c46c2b2358cd1faffc04c1e8248cf, 83e1d9892ef51785cf0760b7681436760dda435a, 47f6090bcf75c369695d21c3f179db8a56bbbd49, 2ca99fc3512a8074de20ee52a87b492dfcc41a4d, 6077d16b5c0f65d571eee709de2f0541fb5ef0ca, 306b0991413b482dbf5585b423022123bb505966 |
| Siemens | RUGGEDCOM RST2428P | before V3.3 | V3.3 |
| Siemens | SCALANCE XC-300/XR-300/XC-400/XR-500WG/XR-500 family | before V3.3 | V3.3 |
| Siemens | SCALANCE XCH328 | before V3.3 | V3.3 |
| Siemens | SCALANCE XCM324 | before V3.3 | V3.3 |
| Siemens | SCALANCE XCM328 | before V3.3 | V3.3 |
| Siemens | SCALANCE XCM332 | before V3.3 | V3.3 |
| Siemens | SCALANCE XRH334 (24 V DC, 8xFO, CC) | before V3.3 | V3.3 |
| Siemens | SCALANCE XRM334 (230 V AC, 12xFO) | before V3.3 | V3.3 |
| Siemens | SCALANCE XRM334 (230 V AC, 8xFO) | before V3.3 | V3.3 |
| Siemens | SCALANCE XRM334 (230V AC, 2x10G, 24xSFP, 8xSFP+) | before V3.3 | V3.3 |
| Siemens | SCALANCE XRM334 (24 V DC, 12xFO) | before V3.3 | V3.3 |
| Siemens | SCALANCE XRM334 (24 V DC, 8xFO) | before V3.3 | V3.3 |
| Siemens | SCALANCE XRM334 (24V DC, 2x10G, 24xSFP, 8xSFP+) | before V3.3 | V3.3 |
| Siemens | SCALANCE XRM334 (2x230 V AC, 12xFO) | before V3.3 | V3.3 |
| Siemens | SCALANCE XRM334 (2x230 V AC, 8xFO) | before V3.3 | V3.3 |
| Siemens | SCALANCE XRM334 (2x230V AC, 2x10G, 24xSFP, 8xSFP+) | before V3.3 | V3.3 |
| Siemens | SIMATIC CN 4100 | before V5.0 | V5.0 |
| Linux | Linux Kernel | 4.14.322 up to, but not including, 4.15; 4.19.291 up to, but not including, 4.20; 5.4.253 up to, but not including, 5.4.299; 5.10.190 up to, but not including, 5.10.243; 5.15.126 up to, but not including, 5.15.192; 6.1.45 up to, but not including, 6.1.151; 6.4.10 up to, but not including, 6.6.105; 6.7 up to, but not including, 6.12.46; and 2 more ranges | 4.15, 4.20, 5.4.299, 5.10.243, 5.15.192, 6.1.151 |
| Debian | Debian Linux | 11.0 | Not stated |
Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.
How the severity score breaks down
- Attack vector
- LocalThe attacker needs local access or must trick a user into running something.
- Attack complexity
- LowNo special conditions are needed; the attack works reliably.
- Privileges required
- LowA basic user account is enough.
- User interaction
- NoneNo action by a victim is required.
- Scope
- UnchangedImpact stays within the vulnerable component.
- Confidentiality
- HighAll data handled by the component can be read.
- Integrity
- HighData or code can be modified at will.
- Availability
- HighThe component can be taken down completely.
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. Scored by NVD.
| Scoring system | Score | Severity | Scored by |
|---|---|---|---|
| CVSS 3.1 | 8.0 | High | CNA |
| CVSS 3.1 | 7.8 | High | NVD |
Official description
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: Fix use-after-free in l2cap_sock_cleanup_listen() syzbot reported the splat below without a repro. In the splat, a single thread calling bt_accept_dequeue() freed sk and touched it after that. The root cause would be the racy l2cap_sock_cleanup_listen() call added by the cited commit. bt_accept_dequeue() is called under lock_sock() except for l2cap_sock_release(). Two threads could see the same socket during the list iteration in bt_accept_dequeue(): CPU1 CPU2 (close()) ---- ---- sock_hold(sk) sock_hold(sk); lock_sock(sk) <-- block close() sock_put(sk) bt_accept_unlink(sk) sock_put(sk) <-- refcnt by bt_accept_enqueue() release_sock(sk) lock_sock(sk) sock_put(sk) bt_accept_unlink(sk) sock_put(sk) <-- last refcnt bt_accept_unlink(sk) <-- UAF Depending on the timing, the other thread could show up in the "Freed by task" part. Let's call l2cap_sock_cleanup_listen() under lock_sock() in l2cap_sock_release(). [0]: BUG: KASAN: slab-use-after-free in debug_spin_lock_before kernel/locking/spinlock_debug.c:86 [inline] BUG: KASAN: slab-use-after-free in do_raw_spin_lock+0x26f/0x2b0 kernel/locking/spinlock_debug.c:115 Read of size 4 at addr ffff88803b7eb1c4 by task syz.5.3276/16995 CPU: 3 UID: 0 PID: 16995 Comm: syz.5.3276 Not tainted syzkaller #0 PREEMPT(full) Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 Call Trace: <TASK> __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:378 [inline] print_report+0xcd/0x630 mm/kasan/report.c:482 kasan_report+0xe0/0x110 mm/kasan/report.c:595 debug_spin_lock_before kernel/locking/spinlock_debug.c:86 [inline] do_raw_spin_lock+0x26f/0x2b0 kernel/locking/spinlock_debug.c:115 spin_lock_bh include/linux/spinlock.h:356 [inline] release_sock+0x21/0x220 net/core/sock.c:3746 bt_accept_dequeue+0x505/0x600 net/bluetooth/af_bluetooth.c:312 l2cap_sock_cleanup_listen+0x5c/0x2a0 net/bluetooth/l2cap_sock.c:1451 l2cap_sock_release+0x5c/0x210 net/bluetooth/l2cap_sock.c:1425 __sock_release+0xb3/0x270 net/socket.c:649 sock_close+0x1c/0x30 net/socket.c:1439 __fput+0x3ff/0xb70 fs/file_table.c:468 task_work_run+0x14d/0x240 kernel/task_work.c:227 resume_user_mode_work include/linux/resume_user_mode.h:50 [inline] exit_to_user_mode_loop+0xeb/0x110 kernel/entry/common.c:43 exit_to_user_mode_prepare include/linux/irq-entry-common.h:225 [inline] syscall_exit_to_user_mode_work include/linux/entry-common.h:175 [inline] syscall_exit_to_user_mode include/linux/entry-common.h:210 [inline] do_syscall_64+0x3f6/0x4c0 arch/x86/entry/syscall_64.c:100 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f2accf8ebe9 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007ffdb6cb1378 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4 RAX: 0000000000000000 RBX: 00000000000426fb RCX: 00007f2accf8ebe9 RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003 RBP: 00007f2acd1b7da0 R08: 0000000000000001 R09: 00000012b6cb166f R10: 0000001b30e20000 R11: 0000000000000246 R12: 00007f2acd1b609c R13: 00007f2acd1b6090 R14: ffffffffffffffff R15: 00007ffdb6cb1490 </TASK> Allocated by task 5326: kasan_save_stack+0x33/0x60 mm/kasan/common.c:47 kasan_save_track+0x14/0x30 mm/kasan/common.c:68 poison_kmalloc_redzone mm/kasan/common.c:388 [inline] __kasan_kmalloc+0xaa/0xb0 mm/kasan/common.c:405 kasan_kmalloc include/linux/kasan.h:260 [inline] __do_kmalloc_node mm/slub.c:4365 [inline] __kmalloc_nopro ---truncated---
Source: the CVE record as published by its numbering authority, via NVD and CVE.org.
The underlying weakness: Use After Free
The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory belongs to the code that operates on the new pointer.
How developers prevent this class of flaw
- Choose a language that provides automatic memory management.
- When freeing pointers, be sure to set them to NULL once they are freed. However, the utilization of multiple or complex data structures may lower the usefulness of this strategy.
Timeline
- CVE record published.
- CISA published its SSVC assessment (exploitation: none, automatable: no, technical impact: total).
- Record last changed materially (score, affected products, status or references).
References
Patches and release notes
- git.kernel.org/stable/c/2ca99fc3512a8074de20ee52a87b492dfcc41a4d
- git.kernel.org/stable/c/306b0991413b482dbf5585b423022123bb505966
- git.kernel.org/stable/c/3dff390f55ccd9ce12e91233849769b5312180c2
- git.kernel.org/stable/c/47f6090bcf75c369695d21c3f179db8a56bbbd49
- git.kernel.org/stable/c/6077d16b5c0f65d571eee709de2f0541fb5ef0ca
- git.kernel.org/stable/c/83e1d9892ef51785cf0760b7681436760dda435a
- git.kernel.org/stable/c/862c628108562d8c7a516a900034823b381d3cba
- git.kernel.org/stable/c/964cbb198f9c46c2b2358cd1faffc04c1e8248cf
Third-party and government advisories
- lists.debian.org/debian-lts-announce/2025/10/msg00007.htmlMailing List, Third Party Advisory
- lists.debian.org/debian-lts-announce/2025/10/msg00008.htmlMailing List, Third Party Advisory
Other references
Recent Use After Free vulnerabilities
- 7.8 High severity
- 7.8 High severity
- 7.8 High severity
- 7.8 High severity
- 7.8 High severity
- 7.8 High severity
Spotted an error? Tell us.