# CVE-2025-39977

## Summary

- **CVE ID:** CVE-2025-39977
- **Severity:** HIGH
- **CVSS Score:** 7.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
- **CWE:** N/A
- **Published:** Oct 15, 2025
- **Last Modified:** Sep 8, 2026

## Description

In the Linux kernel, the following vulnerability has been resolved:

futex: Prevent use-after-free during requeue-PI

syzbot managed to trigger the following race:

   T1                               T2

 futex_wait_requeue_pi()
   futex_do_wait()
     schedule()
                               futex_requeue()
                                 futex_proxy_trylock_atomic()
                                   futex_requeue_pi_prepare()
                                   requeue_pi_wake_futex()
                                     futex_requeue_pi_complete()
                                      /* preempt */

         * timeout/ signal wakes T1 *

   futex_requeue_pi_wakeup_sync() // Q_REQUEUE_PI_LOCKED
   futex_hash_put()
  // back to userland, on stack futex_q is garbage

                                      /* back */
                                     wake_up_state(q->task, TASK_NORMAL);

In this scenario futex_wait_requeue_pi() is able to leave without using
futex_q::lock_ptr for synchronization.

This can be prevented by reading futex_q::task before updating the
futex_q::requeue_state. A reference on the task_struct is not needed
because requeue_pi_wake_futex() is invoked with a spinlock_t held which
implies a RCU read section.

Even if T1 terminates immediately after, the task_struct will remain valid
during T2's wake_up_state().  A READ_ONCE on futex_q::task before
futex_requeue_pi_complete() is enough because it ensures that the variable
is read before the state is updated.

Read futex_q::task before updating the requeue state, use it for the
following wakeup.

## Affected Products

- Linux — Linux (07d91ef510fb16a2e0ca7453222105835b7ba3b8)
- Linux — Linux (5.15)
- Linux — Linux (0)
- Linux — Linux (6.1.155)
- Linux — Linux (6.6.109)
- Linux — Linux (6.12.50)
- Linux — Linux (6.16.10)
- Linux — Linux (6.17)

## References

- [CNA](https://git.kernel.org/stable/c/cb5d19a61274b51b49601214a87af573b43d60fa)
- [CNA](https://git.kernel.org/stable/c/348736955ed6ca6e99ca24b93b1d3fbfe352c181)
- [CNA](https://git.kernel.org/stable/c/a170b9c0dde83312b8b58ccc91509c7c15711641)
- [CNA](https://git.kernel.org/stable/c/d824b2dbdcfe3c390278dd9652ea526168ef6850)
- [CNA](https://git.kernel.org/stable/c/b549113738e8c751b613118032a724b772aa83f2)
- [siemens-SADP](https://cert-portal.siemens.com/productcert/html/ssa-082556.html)
- [siemens-SADP](https://cert-portal.siemens.com/productcert/html/ssa-019113.html)

## Exploitation Prediction (EPSS)

- **EPSS Score:** 0.15%
- **EPSS Percentile:** 4.6

---
_Exported from OnDuty AI Vulnerability Intelligence on 2026-09-19._