CVE-2025-39900: In the Linux kernel, the following vulnerability has been resolved: net_sched: gen_estimator: fix est_timer() vs CONFIG_PREEMPT_RT=y syzbot reported a WARNING…

PriorityP420medium5.5CVSS 3.1

AVLACLPRLUINSUCNINAH

EPSS

0.13%

3.3th percentile

In the Linux kernel, the following vulnerability has been resolved: net_sched: gen_estimator: fix est_timer() vs CONFIG_PREEMPT_RT=y syzbot reported a WARNING in est_timer() [1] Problem here is that with CONFIG_PREEMPT_RT=y, timer callbacks can be preempted. Adopt preempt_disable_nested()/preempt_enable_nested() to fix this. [1] WARNING: CPU: 0 PID: 16 at ./include/linux/seqlock.h:221 __seqprop_assert include/linux/seqlock.h:221 [inline] WARNING: CPU: 0 PID: 16 at ./include/linux/seqlock.h:221 est_timer+0x6dc/0x9f0 net/core/gen_estimator.c:93 Modules linked in: CPU: 0 UID: 0 PID: 16 Comm: ktimers/0 Not tainted syzkaller #0 PREEMPT_{RT,(full)} Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 RIP: 0010:__seqprop_assert include/linux/seqlock.h:221 [inline] RIP: 0010:est_timer+0x6dc/0x9f0 net/core/gen_estimator.c:93 Call Trace: call_timer_fn+0x17e/0x5f0 kernel/time/timer.c:1747 expire_timers kernel/time/timer.c:1798 [inline] __run_timers kernel/time/timer.c:2372 [inline] __run_timer_base+0x648/0x970 kernel/time/timer.c:2384 run_timer_base kernel/time/timer.c:2393 [inline] run_timer_softirq+0xb7/0x180 kernel/time/timer.c:2403 handle_softirqs+0x22c/0x710 kernel/softirq.c:579 __do_softirq kernel/softirq.c:613 [inline] run_ktimerd+0xcf/0x190 kernel/softirq.c:1043 smpboot_thread_fn+0x53f/0xa60 kernel/smpboot.c:160 kthread+0x70e/0x8a0 kernel/kthread.c:463 ret_from_fork+0x3fc/0x770 arch/x86/kernel/process.c:148 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245

Affected

10 ranges

Vendor	Product	Version range	Fixed in
debian	linux	< linux 6.16.6-1 (forky)	linux 6.16.6-1 (forky)
linux	linux	—	—
linux	linux	>= d2d6422f8bd17c6bb205133e290625a564194496 < a22ec2ee824be30803068a52f78f7ffe3bc879fb	a22ec2ee824be30803068a52f78f7ffe3bc879fb
linux	linux	>= d2d6422f8bd17c6bb205133e290625a564194496 < e79923824c48b930609680be04cb29253fc4a17d	e79923824c48b930609680be04cb29253fc4a17d
linux	linux	>= d2d6422f8bd17c6bb205133e290625a564194496 < 9f74c0ea9b26d1505d55b61e36b1623dd347e1d1	9f74c0ea9b26d1505d55b61e36b1623dd347e1d1
linux	linux_kernel	—	—
linux	linux_kernel	>= 0 < 6.12.48-1	6.12.48-1
linux	linux_kernel	>= 0 < 6.16.6-1	6.16.6-1
linux	linux_kernel	>= 6.12 < 6.12.46	6.12.46
linux	linux_kernel	>= 6.13 < 6.16.6	6.16.6

CVSS provenance

nvdv3.15.5MEDIUMCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

osv5.5MEDIUM

vendor_debian5.5LOW

vendor_redhat5.5MEDIUM

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.