CVE-2025-39977

Vulnerability

CVE-2025-39977: Use-After-Free in Linux Kernel Futex Requeue-PI Requeue

A race condition exists in the Linux kernel's futex subsystem, specifically in the futex_wait_requeue_pi() and futex_requeue() code paths. The vulnerability occurs when a thread (T1) waiting on a futex via futex_wait_requeue_pi() is woken by a timeout or signal while a second thread (T2) is concurrently performing a requeue-PI operation. T2's requeue_pi_wake_futex() function updates the requeue state and then attempts to wake T1, but T1 may have already exited the futex wait and returned to user space, leaving the futex_q structure on the stack as garbage. The wake-up operation then accesses freed memory, leading to a use-after-free condition [1].

##Exploitation

An attacker would need to be able to trigger the specific race window between the two threads. This requires local access to the system and the ability to create and control futex operations. The race is triggered when T1's wait is interrupted (by signal or timeout) precisely during the window where T2 has completed the requeue preparation but before the wake-up call. The vulnerability is exploitable because the wake_up_state() call in requeue_pi_wake_futex() uses a pointer to the task that task_struct that may have been freed after T1 returns to user space [1].

##Impact

Successful exploitation could allow an attacker to corrupt kernel memory, potentially leading to privilege escalation, denial of service, or arbitrary code execution in kernel context. The vulnerability is rated with a CVSS score of 7.8 (High) [1].

##Mitigation

The fix, committed to the Linux kernel stable tree, ensures that futex_q::task is read before updating the requeue state, preventing the use a READ_ONCE to guarantee the ordering. This prevents the use-after-free by ensuring the task pointer remains valid during the wake-up call [1]. Users should apply the latest kernel updates from their distribution. The vulnerability affects all kernels prior to the fix, including those used in Siemens SIMATIC S7-1500 CPU family products [1].