CVE-2025-39877
published 2025-09-23CVE-2025-39877: In the Linux kernel, the following vulnerability has been resolved: mm/damon/sysfs: fix use-after-free in state_show() state_show() reads kdamond->damon_ctx…
high7.8CVSS 3.1
AVLACLPRLUINSUCHIHAH
In the Linux kernel, the following vulnerability has been resolved:
mm/damon/sysfs: fix use-after-free in state_show()
state_show() reads kdamond->damon_ctx without holding damon_sysfs_lock.
This allows a use-after-free race:
CPU 0 CPU 1
----- -----
state_show() damon_sysfs_turn_damon_on()
ctx = kdamond->damon_ctx; mutex_lock(&damon_sysfs_lock);
damon_destroy_ctx(kdamond->damon_ctx);
kdamond->damon_ctx = NULL;
mutex_unlock(&damon_sysfs_lock);
damon_is_running(ctx); /* ctx is freed */
mutex_lock(&ctx->kdamond_lock); /* UAF */
(The race can also occur with damon_sysfs_kdamonds_rm_dirs() and
damon_sysfs_kdamond_release(), which free or replace the context under
damon_sysfs_lock.)
Fix by taking damon_sysfs_lock before dereferencing the context, mirroring
the locking used in pid_show().
The bug has existed since state_show() first accessed kdamond->damon_ctx.
Affected
20 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | debian_linux | — | — |
| debian | linux | < linux 6.1.153-1 (bookworm) | linux 6.1.153-1 (bookworm) |
| debian | linux-6.1 | < linux 6.1.153-1 (bookworm) | linux 6.1.153-1 (bookworm) |
| linux | linux | — | — |
| linux | linux | >= a61ea561c87139992fe32afdee48a6f6b85d824a < 3858c44341ad49dc7544b19cc9f9ecffaa7cc50e | 3858c44341ad49dc7544b19cc9f9ecffaa7cc50e |
| linux | linux | >= a61ea561c87139992fe32afdee48a6f6b85d824a < 60d7a3d2b985a395318faa1d88da6915fad11c19 | 60d7a3d2b985a395318faa1d88da6915fad11c19 |
| linux | linux | >= a61ea561c87139992fe32afdee48a6f6b85d824a < 26d29b2ac87a2989071755f9828ebf839b560d4c | 26d29b2ac87a2989071755f9828ebf839b560d4c |
| linux | linux | >= a61ea561c87139992fe32afdee48a6f6b85d824a < 4e87f461d61959647464a94d11ae15c011be58ce | 4e87f461d61959647464a94d11ae15c011be58ce |
| linux | linux | >= a61ea561c87139992fe32afdee48a6f6b85d824a < 3260a3f0828e06f5f13fac69fb1999a6d60d9cff | 3260a3f0828e06f5f13fac69fb1999a6d60d9cff |
| linux | linux_kernel | — | — |
| linux | linux_kernel | >= 0 < 6.1.153-1 | 6.1.153-1 |
| linux | linux_kernel | >= 0 < 6.12.48-1 | 6.12.48-1 |
| linux | linux_kernel | >= 0 < 6.16.8-1 | 6.16.8-1 |
| linux | linux_kernel | >= 0 < 6.8.0-106.106 | 6.8.0-106.106 |
| linux | linux_kernel | >= 5.18 < 6.1.153 | 6.1.153 |
| linux | linux_kernel | >= 6.13 < 6.16.8 | 6.16.8 |
| linux | linux_kernel | >= 6.2 < 6.6.107 | 6.6.107 |
| linux | linux_kernel | >= 6.7 < 6.12.48 | 6.12.48 |
| msrc | azl3_kernel_6.6.96.2-2_on_azure_linux_3.0 | — | — |
| ubuntu | linux-xilinx | — | — |
CVSS provenance
nvdv3.17.8HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
osv7.8HIGH