CVE-2025-39877: mm/damon/sysfs: fix use-after-free in state_show()
In the Linux kernel, the following vulnerability has been resolved:
mm/damon/sysfs: fix use-after-free in stateshow()
stateshow() reads kdamond->damonctx without holding damonsysfslock. This allows a use-after-free race:
CPU 0 CPU 1 ----- ----- stateshow() damonsysfsturndamonon() ctx = kdamond->damonctx; mutexlock(&damonsysfslock); damondestroyctx(kdamond->damonctx); kdamond->damonctx = NULL; mutexunlock(&damonsysfslock); damonisrunning(ctx); / ctx is freed / mutexlock(&ctx->kdamondlock); / UAF /
(The race can also occur with damonsysfskdamondsrmdirs() and damonsysfskdamondrelease(), which free or replace the context under damonsysfslock.)
Fix by taking damonsysfslock before dereferencing the context, mirroring the locking used in pidshow().
The bug has existed since stateshow() first accessed kdamond->damonctx.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2025-39877?
CVE-2025-39877 has a high severity due to the potential for a use-after-free vulnerability that could lead to remote code execution.
How do I fix CVE-2025-39877?
To fix CVE-2025-39877, update your Linux kernel to the latest patched version that addresses this vulnerability.
What impact does CVE-2025-39877 have on the Linux kernel?
CVE-2025-39877 allows for the possibility of unauthorized access and manipulation of data due to a race condition in state_show().
Who is affected by CVE-2025-39877?
Any system running an unpatched version of the Linux kernel is potentially affected by CVE-2025-39877.
Is CVE-2025-39877 being actively exploited?
As of now, there are no confirmed reports of CVE-2025-39877 being actively exploited in the wild.