{"id":"CVE-2025-39866","state":"PUBLISHED","title":"fs: writeback: fix use-after-free in __mark_inode_dirty()","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nfs: writeback: fix use-after-free in __mark_inode_dirty()\n\nAn use-after-free issue occurred when __mark_inode_dirty() get the\nbdi_writeback that was in the progress of switching.\n\nCPU: 1 PID: 562 Comm: systemd-random- Not tainted 6.6.56-gb4403bd46a8e #1\n......\npstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)\npc : __mark_inode_dirty+0x124/0x418\nlr : __mark_inode_dirty+0x118/0x418\nsp : ffffffc08c9dbbc0\n........\nCall trace:\n __mark_inode_dirty+0x124/0x418\n generic_update_time+0x4c/0x60\n file_modified+0xcc/0xd0\n ext4_buffered_write_iter+0x58/0x124\n ext4_file_write_iter+0x54/0x704\n vfs_write+0x1c0/0x308\n ksys_write+0x74/0x10c\n __arm64_sys_write+0x1c/0x28\n invoke_syscall+0x48/0x114\n el0_svc_common.constprop.0+0xc0/0xe0\n do_el0_svc+0x1c/0x28\n el0_svc+0x40/0xe4\n el0t_64_sync_handler+0x120/0x12c\n el0t_64_sync+0x194/0x198\n\nRoot cause is:\n\nsystemd-random-seed                         kworker\n----------------------------------------------------------------------\n___mark_inode_dirty                     inode_switch_wbs_work_fn\n\n  spin_lock(&inode->i_lock);\n  inode_attach_wb\n  locked_inode_to_wb_and_lock_list\n     get inode->i_wb\n     spin_unlock(&inode->i_lock);\n     spin_lock(&wb->list_lock)\n  spin_lock(&inode->i_lock)\n  inode_io_list_move_locked\n  spin_unlock(&wb->list_lock)\n  spin_unlock(&inode->i_lock)\n                                    spin_lock(&old_wb->list_lock)\n                                      inode_do_switch_wbs\n                                        spin_lock(&inode->i_lock)\n                                        inode->i_wb = new_wb\n                                        spin_unlock(&inode->i_lock)\n                                    spin_unlock(&old_wb->list_lock)\n                                    wb_put_many(old_wb, nr_switched)\n                                      cgwb_release\n                                      old wb released\n  wb_wakeup_delayed() accesses wb,\n  then trigger the use-after-free\n  issue\n\nFix this race condition by holding inode spinlock until\nwb_wakeup_delayed() finished.","publishedAt":"2025-09-19T15:26:35.725Z","updatedAt":"2026-10-15T22:02:32.619Z","severity":{"score":7.8,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","source":"Linux"},"assigner":"Linux","products":["Linux Linux"],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"0747259d13febfcc838980a63c414c9b920cea6f","status":"affected","lessThan":"e2a14bbae5d8bacaa301362744a110e2be40a3a3","versionType":"git"},{"version":"0747259d13febfcc838980a63c414c9b920cea6f","status":"affected","lessThan":"b187c976111960e6e54a6b1fff724f6e3d39406c","versionType":"git"},{"version":"0747259d13febfcc838980a63c414c9b920cea6f","status":"affected","lessThan":"1edc2feb9c759a9883dfe81cb5ed231412d8b2e4","versionType":"git"},{"version":"0747259d13febfcc838980a63c414c9b920cea6f","status":"affected","lessThan":"bf89b1f87c72df79cf76203f71fbf8349cd5c9de","versionType":"git"},{"version":"0747259d13febfcc838980a63c414c9b920cea6f","status":"affected","lessThan":"e63052921f1b25a836feb1500b841bff7a4a0456","versionType":"git"},{"version":"0747259d13febfcc838980a63c414c9b920cea6f","status":"affected","lessThan":"c8c14adf80bd1a6e4a1d7ee9c2a816881c26d17a","versionType":"git"},{"version":"0747259d13febfcc838980a63c414c9b920cea6f","status":"affected","lessThan":"d02d2c98d25793902f65803ab853b592c7a96b29","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["fs/fs-writeback.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"4.2","status":"affected"},{"version":"0","status":"unaffected","lessThan":"4.2","versionType":"semver"},{"version":"5.10.247","status":"unaffected","lessThanOrEqual":"5.10.*","versionType":"semver"},{"version":"5.15.192","status":"unaffected","lessThanOrEqual":"5.15.*","versionType":"semver"},{"version":"6.1.151","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.6.105","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.12.46","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.16.6","status":"unaffected","lessThanOrEqual":"6.16.*","versionType":"semver"},{"version":"6.17","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["fs/fs-writeback.c"]}],"references":["https://git.kernel.org/stable/c/e2a14bbae5d8bacaa301362744a110e2be40a3a3","https://git.kernel.org/stable/c/b187c976111960e6e54a6b1fff724f6e3d39406c","https://git.kernel.org/stable/c/1edc2feb9c759a9883dfe81cb5ed231412d8b2e4","https://git.kernel.org/stable/c/bf89b1f87c72df79cf76203f71fbf8349cd5c9de","https://git.kernel.org/stable/c/e63052921f1b25a836feb1500b841bff7a4a0456","https://git.kernel.org/stable/c/c8c14adf80bd1a6e4a1d7ee9c2a816881c26d17a","https://git.kernel.org/stable/c/d02d2c98d25793902f65803ab853b592c7a96b29","https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html","https://cert-portal.siemens.com/productcert/html/ssa-082556.html","https://cert-portal.siemens.com/productcert/html/ssa-032379.html","https://cert-portal.siemens.com/productcert/html/ssa-019113.html","https://cert-portal.siemens.com/productcert/html/ssa-457936.html"],"weaknesses":[],"ingestedAt":"2026-10-29T20:09:09.358Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2025/39xxx/CVE-2025-39866.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2025-39866","state":"PUBLISHED","datePublished":"2025-09-19T15:26:35.725Z","dateUpdated":"2026-10-15T22:02:32.619Z","assignerShortName":"Linux","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateReserved":"2025-04-16T07:20:57.143Z"},"containers":{"cna":{"title":"fs: writeback: fix use-after-free in __mark_inode_dirty()","descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nfs: writeback: fix use-after-free in __mark_inode_dirty()\n\nAn use-after-free issue occurred when __mark_inode_dirty() get the\nbdi_writeback that was in the progress of switching.\n\nCPU: 1 PID: 562 Comm: systemd-random- Not tainted 6.6.56-gb4403bd46a8e #1\n......\npstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)\npc : __mark_inode_dirty+0x124/0x418\nlr : __mark_inode_dirty+0x118/0x418\nsp : ffffffc08c9dbbc0\n........\nCall trace:\n __mark_inode_dirty+0x124/0x418\n generic_update_time+0x4c/0x60\n file_modified+0xcc/0xd0\n ext4_buffered_write_iter+0x58/0x124\n ext4_file_write_iter+0x54/0x704\n vfs_write+0x1c0/0x308\n ksys_write+0x74/0x10c\n __arm64_sys_write+0x1c/0x28\n invoke_syscall+0x48/0x114\n el0_svc_common.constprop.0+0xc0/0xe0\n do_el0_svc+0x1c/0x28\n el0_svc+0x40/0xe4\n el0t_64_sync_handler+0x120/0x12c\n el0t_64_sync+0x194/0x198\n\nRoot cause is:\n\nsystemd-random-seed                         kworker\n----------------------------------------------------------------------\n___mark_inode_dirty                     inode_switch_wbs_work_fn\n\n  spin_lock(&inode->i_lock);\n  inode_attach_wb\n  locked_inode_to_wb_and_lock_list\n     get inode->i_wb\n     spin_unlock(&inode->i_lock);\n     spin_lock(&wb->list_lock)\n  spin_lock(&inode->i_lock)\n  inode_io_list_move_locked\n  spin_unlock(&wb->list_lock)\n  spin_unlock(&inode->i_lock)\n                                    spin_lock(&old_wb->list_lock)\n                                      inode_do_switch_wbs\n                                        spin_lock(&inode->i_lock)\n                                        inode->i_wb = new_wb\n                                        spin_unlock(&inode->i_lock)\n                                    spin_unlock(&old_wb->list_lock)\n                                    wb_put_many(old_wb, nr_switched)\n                                      cgwb_release\n                                      old wb released\n  wb_wakeup_delayed() accesses wb,\n  then trigger the use-after-free\n  issue\n\nFix this race condition by holding inode spinlock until\nwb_wakeup_delayed() finished."}],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"0747259d13febfcc838980a63c414c9b920cea6f","status":"affected","lessThan":"e2a14bbae5d8bacaa301362744a110e2be40a3a3","versionType":"git"},{"version":"0747259d13febfcc838980a63c414c9b920cea6f","status":"affected","lessThan":"b187c976111960e6e54a6b1fff724f6e3d39406c","versionType":"git"},{"version":"0747259d13febfcc838980a63c414c9b920cea6f","status":"affected","lessThan":"1edc2feb9c759a9883dfe81cb5ed231412d8b2e4","versionType":"git"},{"version":"0747259d13febfcc838980a63c414c9b920cea6f","status":"affected","lessThan":"bf89b1f87c72df79cf76203f71fbf8349cd5c9de","versionType":"git"},{"version":"0747259d13febfcc838980a63c414c9b920cea6f","status":"affected","lessThan":"e63052921f1b25a836feb1500b841bff7a4a0456","versionType":"git"},{"version":"0747259d13febfcc838980a63c414c9b920cea6f","status":"affected","lessThan":"c8c14adf80bd1a6e4a1d7ee9c2a816881c26d17a","versionType":"git"},{"version":"0747259d13febfcc838980a63c414c9b920cea6f","status":"affected","lessThan":"d02d2c98d25793902f65803ab853b592c7a96b29","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["fs/fs-writeback.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"4.2","status":"affected"},{"version":"0","status":"unaffected","lessThan":"4.2","versionType":"semver"},{"version":"5.10.247","status":"unaffected","lessThanOrEqual":"5.10.*","versionType":"semver"},{"version":"5.15.192","status":"unaffected","lessThanOrEqual":"5.15.*","versionType":"semver"},{"version":"6.1.151","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.6.105","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.12.46","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.16.6","status":"unaffected","lessThanOrEqual":"6.16.*","versionType":"semver"},{"version":"6.17","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["fs/fs-writeback.c"]}],"references":[{"url":"https://git.kernel.org/stable/c/e2a14bbae5d8bacaa301362744a110e2be40a3a3"},{"url":"https://git.kernel.org/stable/c/b187c976111960e6e54a6b1fff724f6e3d39406c"},{"url":"https://git.kernel.org/stable/c/1edc2feb9c759a9883dfe81cb5ed231412d8b2e4"},{"url":"https://git.kernel.org/stable/c/bf89b1f87c72df79cf76203f71fbf8349cd5c9de"},{"url":"https://git.kernel.org/stable/c/e63052921f1b25a836feb1500b841bff7a4a0456"},{"url":"https://git.kernel.org/stable/c/c8c14adf80bd1a6e4a1d7ee9c2a816881c26d17a"},{"url":"https://git.kernel.org/stable/c/d02d2c98d25793902f65803ab853b592c7a96b29"}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:L - The vulnerable code is reached from an ordinary write(2) syscall (vfs_write → ext4_buffered_write_iter → file_modified → generic_update_time → __mark_inode_dirty), and the competing side requires local cgroup/writeback activity. No network protocol handler is involved.\nAC:L - The attacker drives both sides of the race — a multi-threaded write() loop dirties the inode while the attacker forces cgroup writeback switches by dirtying the file from a second memcg and tearing that cgroup down, making the old wb's last reference drop. Attempts are unlimited and the bug was observed occurring spontaneously during normal boot, and CONFIG_CGROUP_WRITEBACK is default-y on all mainstream kernels.\nPR:L - Only an unprivileged local account with write access to a file on a writeback-capable filesystem (ext4/xfs home or /tmp) is needed; cgroup manipulation used to widen the race is available to ordinary users through systemd's delegated per-user cgroup subtree.\nUI:N - The attacker triggers everything itself through its own write() syscalls and cgroup activity; no victim action or interaction is required.\nS:U - The use-after-free corrupts kernel heap memory within the same kernel security authority; there is no VM, IOMMU, or sandbox boundary crossed.\nC:H - The freed bdi_writeback is dereferenced as `wb->bdi->capabilities`, so a re-sprayed object yields an attacker-controlled pointer dereference and an arbitrary kernel-memory read primitive, enabling disclosure of arbitrary kernel data.\nI:H - wb_wakeup_delayed() writes into the freed object (spin_lock_irq on wb->work_lock) and inserts the freed `wb->dwork` timer into the timer wheel, giving list-write primitives and an attacker-controlled `timer->function` — a direct control-flow hijack path to arbitrary kernel code execution.\nA:H - The use-after-free reliably produces a kernel oops/panic as reported in the original crash trace (__mark_inode_dirty+0x124), and can be triggered repeatedly to crash the system."}]}],"providerMetadata":{"shortName":"Linux","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateUpdated":"2026-08-05T12:05:45.584Z"},"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.2","versionEndExcluding":"5.10.247"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.2","versionEndExcluding":"5.15.192"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.2","versionEndExcluding":"6.1.151"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.2","versionEndExcluding":"6.6.105"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.2","versionEndExcluding":"6.12.46"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.2","versionEndExcluding":"6.16.6"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.2","versionEndExcluding":"6.17"}]}]}],"x_generator":{"engine":"bippy-1.2.0"}},"adp":[{"title":"CVE Program Container","references":[{"url":"https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html"}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2025-11-03T17:44:17.299Z"}},{"affected":[{"vendor":"Siemens","product":"SIMATIC CN 4100","defaultStatus":"unknown","versions":[{"version":"0","status":"affected","lessThan":"V5.0","versionType":"custom"}]},{"vendor":"Siemens","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP","defaultStatus":"unknown","versions":[{"version":"V3.1.5","status":"affected","lessThan":"*","versionType":"custom"}]},{"vendor":"Siemens","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP","defaultStatus":"unknown","versions":[{"version":"V3.1.6","status":"affected","lessThan":"*","versionType":"custom"}]},{"vendor":"Siemens","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP","defaultStatus":"unknown","versions":[{"version":"V3.1.7","status":"affected","lessThan":"*","versionType":"custom"}]},{"vendor":"Siemens","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP","defaultStatus":"unknown","versions":[{"version":"V3.1.5","status":"affected","lessThan":"*","versionType":"custom"}]},{"vendor":"Siemens","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP","defaultStatus":"unknown","versions":[{"version":"V3.1.6","status":"affected","lessThan":"*","versionType":"custom"}]},{"vendor":"Siemens","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP","defaultStatus":"unknown","versions":[{"version":"V3.1.7","status":"affected","lessThan":"*","versionType":"custom"}]},{"vendor":"Siemens","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP","defaultStatus":"unknown","versions":[{"version":"V3.1.5","status":"affected","lessThan":"*","versionType":"custom"}]},{"vendor":"Siemens","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP","defaultStatus":"unknown","versions":[{"version":"V3.1.6","status":"affected","lessThan":"*","versionType":"custom"}]},{"vendor":"Siemens","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP","defaultStatus":"unknown","versions":[{"version":"V3.1.7","status":"affected","lessThan":"*","versionType":"custom"}]},{"vendor":"Siemens","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP","defaultStatus":"unknown","versions":[{"version":"V3.1.5","status":"affected","lessThan":"*","versionType":"custom"}]},{"vendor":"Siemens","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP","defaultStatus":"unknown","versions":[{"version":"V3.1.6","status":"affected","lessThan":"*","versionType":"custom"}]},{"vendor":"Siemens","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP","defaultStatus":"unknown","versions":[{"version":"V3.1.7","status":"affected","lessThan":"*","versionType":"custom"}]},{"vendor":"Siemens","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP","defaultStatus":"unknown","versions":[{"version":"V3.1.5","status":"affected","lessThan":"*","versionType":"custom"}]},{"vendor":"Siemens","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP","defaultStatus":"unknown","versions":[{"version":"V3.1.6","status":"affected","lessThan":"*","versionType":"custom"}]},{"vendor":"Siemens","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP","defaultStatus":"unknown","versions":[{"version":"V3.1.7","status":"affected","lessThan":"*","versionType":"custom"}]}],"references":[{"url":"https://cert-portal.siemens.com/productcert/html/ssa-082556.html"},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-032379.html"},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-019113.html"},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-457936.html"}],"providerMetadata":{"shortName":"siemens-SADP","orgId":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","dateUpdated":"2026-10-15T01:08:32.258Z"},"x_adpType":"supplier"},{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2025-39866","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-10-15T21:54:28.454479Z"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-10-15T22:02:32.619Z"}}]}}}