{"id":"CVE-2025-39976","state":"PUBLISHED","title":"futex: Use correct exit on failure from futex_hash_allocate_default()","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nfutex: Use correct exit on failure from futex_hash_allocate_default()\n\ncopy_process() uses the wrong error exit path from futex_hash_allocate_default().\nAfter exiting from futex_hash_allocate_default(), neither tasklist_lock\nnor siglock has been acquired. The exit label bad_fork_core_free unlocks\nboth of these locks which is wrong.\n\nThe next exit label, bad_fork_cancel_cgroup, is the correct exit.\nsched_cgroup_fork() did not allocate any resources that need to freed.\n\nUse bad_fork_cancel_cgroup on error exit from futex_hash_allocate_default().","publishedAt":"2025-10-15T07:55:57.608Z","updatedAt":"2026-08-05T12:06:45.033Z","severity":{"score":7.8,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","source":"Linux"},"assigner":"Linux","products":["Linux Linux"],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"7c4f75a21f636486d2969d9b6680403ea8483539","status":"affected","lessThan":"f1635765cd0fdbf27b04d9a50be91a01b5adda13","versionType":"git"},{"version":"7c4f75a21f636486d2969d9b6680403ea8483539","status":"affected","lessThan":"4ec3c15462b9f44562f45723a92e2807746ba7d1","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["kernel/fork.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"6.16","status":"affected"},{"version":"0","status":"unaffected","lessThan":"6.16","versionType":"semver"},{"version":"6.16.10","status":"unaffected","lessThanOrEqual":"6.16.*","versionType":"semver"},{"version":"6.17","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["kernel/fork.c"]}],"references":["https://git.kernel.org/stable/c/f1635765cd0fdbf27b04d9a50be91a01b5adda13","https://git.kernel.org/stable/c/4ec3c15462b9f44562f45723a92e2807746ba7d1"],"weaknesses":[],"ingestedAt":"2026-10-29T20:09:09.358Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2025/39xxx/CVE-2025-39976.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2025-39976","state":"PUBLISHED","datePublished":"2025-10-15T07:55:57.608Z","dateUpdated":"2026-08-05T12:06:45.033Z","assignerShortName":"Linux","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateReserved":"2025-04-16T07:20:57.150Z"},"containers":{"cna":{"title":"futex: Use correct exit on failure from futex_hash_allocate_default()","descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nfutex: Use correct exit on failure from futex_hash_allocate_default()\n\ncopy_process() uses the wrong error exit path from futex_hash_allocate_default().\nAfter exiting from futex_hash_allocate_default(), neither tasklist_lock\nnor siglock has been acquired. The exit label bad_fork_core_free unlocks\nboth of these locks which is wrong.\n\nThe next exit label, bad_fork_cancel_cgroup, is the correct exit.\nsched_cgroup_fork() did not allocate any resources that need to freed.\n\nUse bad_fork_cancel_cgroup on error exit from futex_hash_allocate_default()."}],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"7c4f75a21f636486d2969d9b6680403ea8483539","status":"affected","lessThan":"f1635765cd0fdbf27b04d9a50be91a01b5adda13","versionType":"git"},{"version":"7c4f75a21f636486d2969d9b6680403ea8483539","status":"affected","lessThan":"4ec3c15462b9f44562f45723a92e2807746ba7d1","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["kernel/fork.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"6.16","status":"affected"},{"version":"0","status":"unaffected","lessThan":"6.16","versionType":"semver"},{"version":"6.16.10","status":"unaffected","lessThanOrEqual":"6.16.*","versionType":"semver"},{"version":"6.17","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["kernel/fork.c"]}],"references":[{"url":"https://git.kernel.org/stable/c/f1635765cd0fdbf27b04d9a50be91a01b5adda13"},{"url":"https://git.kernel.org/stable/c/4ec3c15462b9f44562f45723a92e2807746ba7d1"}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:L - The bug is reached through the clone()/clone3() syscall path (copy_process) combined with prctl(PR_FUTEX_HASH), both requiring local execution on the target system. There is no network-facing component in kernel/fork.c or kernel/futex/core.c.\nAC:L - The attacker fully controls both failure routes: forcing -ENOMEM on the GFP_KERNEL_ACCOUNT kvzalloc/alloc_percpu by sitting at a memcg limit is essentially deterministic, and the -EBUSY route is a race whose both sides (prctl PR_FUTEX_HASH_SET_SLOTS=0 and a clone(CLONE_VM) loop) are attacker-driven with unlimited retries. CONFIG_FUTEX_PRIVATE_HASH is default y on virtually all MMU builds, so no rare configuration is needed.\nPR:L - Any unprivileged local user can call pthread_create()/clone(CLONE_VM) and prctl(PR_FUTEX_HASH), neither of which has any capability check in kernel/sys.c or futex_hash_prctl(). No root, no namespace tricks, and no CAP_* are required.\nUI:N - The attacker triggers the faulty error path entirely from its own process via syscalls; no action by any other user or administrator is needed.\nS:U - The corrupted state (preempt_count, tasklist_lock, sighand->siglock, task/pid lists) is all within the kernel's own security authority on the same host. No hypervisor, IOMMU, or sandbox boundary is crossed.\nC:H - Spuriously releasing the global tasklist_lock and a shared sighand->siglock lets concurrent writers mutate the task list, thread list, pid hash, and signal structures simultaneously, producing list corruption and use-after-free of task_struct/sighand that can be groomed into a kernel memory read primitive. Per kernel scoring guidance, memory corruption leveragable for information disclosure is High.\nI:H - The stolen tasklist_lock/siglock permit racing list_add/list_del on global kernel structures, yielding dangling pointers and attacker-influenced writes, a classic path to control-flow hijack and privilege escalation. Additionally, preempt_count underflow leaves the CPU with corrupted context-tracking state that violates every atomicity assumption in the scheduler and RCU.\nA:H - Two unmatched preempt_enable() calls underflow the per-CPU preempt_count so the CPU permanently appears to be in hardirq/NMI context, breaking RCU, softirq processing, and preemption, which leads to RCU stalls, soft lockups, or panic; debug kernels BUG immediately on the bad unlock balance. Task-list corruption from the stolen tasklist_lock independently produces kernel oopses."}]}],"providerMetadata":{"shortName":"Linux","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateUpdated":"2026-08-05T12:06:45.033Z"},"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.16","versionEndExcluding":"6.16.10"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.16","versionEndExcluding":"6.17"}]}]}],"x_generator":{"engine":"bippy-1.2.0"}}}}}