CVE-2025-39976 (GCVE-0-2025-39976)

Vulnerability from cvelistv5 – Published: 2025-10-15 07:55 – Updated: 2026-08-05 12:06
VLAI
Title
futex: Use correct exit on failure from futex_hash_allocate_default()
Summary
In the Linux kernel, the following vulnerability has been resolved: futex: Use correct exit on failure from futex_hash_allocate_default() copy_process() uses the wrong error exit path from futex_hash_allocate_default(). After exiting from futex_hash_allocate_default(), neither tasklist_lock nor siglock has been acquired. The exit label bad_fork_core_free unlocks both of these locks which is wrong. The next exit label, bad_fork_cancel_cgroup, is the correct exit. sched_cgroup_fork() did not allocate any resources that need to freed. Use bad_fork_cancel_cgroup on error exit from futex_hash_allocate_default().
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 7c4f75a21f636486d2969d9b6680403ea8483539 , < f1635765cd0fdbf27b04d9a50be91a01b5adda13 (git)
Affected: 7c4f75a21f636486d2969d9b6680403ea8483539 , < 4ec3c15462b9f44562f45723a92e2807746ba7d1 (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.16
Unaffected: 0 , < 6.16 (semver)
Unaffected: 6.16.10 , ≤ 6.16.* (semver)
Unaffected: 6.17 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "kernel/fork.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "f1635765cd0fdbf27b04d9a50be91a01b5adda13",
              "status": "affected",
              "version": "7c4f75a21f636486d2969d9b6680403ea8483539",
              "versionType": "git"
            },
            {
              "lessThan": "4ec3c15462b9f44562f45723a92e2807746ba7d1",
              "status": "affected",
              "version": "7c4f75a21f636486d2969d9b6680403ea8483539",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "kernel/fork.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.16"
            },
            {
              "lessThan": "6.16",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.16.*",
              "status": "unaffected",
              "version": "6.16.10",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.17",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.16.10",
                  "versionStartIncluding": "6.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.17",
                  "versionStartIncluding": "6.16",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nfutex: Use correct exit on failure from futex_hash_allocate_default()\n\ncopy_process() uses the wrong error exit path from futex_hash_allocate_default().\nAfter exiting from futex_hash_allocate_default(), neither tasklist_lock\nnor siglock has been acquired. The exit label bad_fork_core_free unlocks\nboth of these locks which is wrong.\n\nThe next exit label, bad_fork_cancel_cgroup, is the correct exit.\nsched_cgroup_fork() did not allocate any resources that need to freed.\n\nUse bad_fork_cancel_cgroup on error exit from futex_hash_allocate_default()."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The bug is reached through the clone()/clone3() syscall path (copy_process) combined with prctl(PR_FUTEX_HASH), both requiring local execution on the target system. There is no network-facing component in kernel/fork.c or kernel/futex/core.c.\nAC:L - The attacker fully controls both failure routes: forcing -ENOMEM on the GFP_KERNEL_ACCOUNT kvzalloc/alloc_percpu by sitting at a memcg limit is essentially deterministic, and the -EBUSY route is a race whose both sides (prctl PR_FUTEX_HASH_SET_SLOTS=0 and a clone(CLONE_VM) loop) are attacker-driven with unlimited retries. CONFIG_FUTEX_PRIVATE_HASH is default y on virtually all MMU builds, so no rare configuration is needed.\nPR:L - Any unprivileged local user can call pthread_create()/clone(CLONE_VM) and prctl(PR_FUTEX_HASH), neither of which has any capability check in kernel/sys.c or futex_hash_prctl(). No root, no namespace tricks, and no CAP_* are required.\nUI:N - The attacker triggers the faulty error path entirely from its own process via syscalls; no action by any other user or administrator is needed.\nS:U - The corrupted state (preempt_count, tasklist_lock, sighand-\u003esiglock, task/pid lists) is all within the kernel\u0027s own security authority on the same host. No hypervisor, IOMMU, or sandbox boundary is crossed.\nC:H - Spuriously releasing the global tasklist_lock and a shared sighand-\u003esiglock lets concurrent writers mutate the task list, thread list, pid hash, and signal structures simultaneously, producing list corruption and use-after-free of task_struct/sighand that can be groomed into a kernel memory read primitive. Per kernel scoring guidance, memory corruption leveragable for information disclosure is High.\nI:H - The stolen tasklist_lock/siglock permit racing list_add/list_del on global kernel structures, yielding dangling pointers and attacker-influenced writes, a classic path to control-flow hijack and privilege escalation. Additionally, preempt_count underflow leaves the CPU with corrupted context-tracking state that violates every atomicity assumption in the scheduler and RCU.\nA:H - Two unmatched preempt_enable() calls underflow the per-CPU preempt_count so the CPU permanently appears to be in hardirq/NMI context, breaking RCU, softirq processing, and preemption, which leads to RCU stalls, soft lockups, or panic; debug kernels BUG immediately on the bad unlock balance. Task-list corruption from the stolen tasklist_lock independently produces kernel oopses."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:06:45.033Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/f1635765cd0fdbf27b04d9a50be91a01b5adda13"
        },
        {
          "url": "https://git.kernel.org/stable/c/4ec3c15462b9f44562f45723a92e2807746ba7d1"
        }
      ],
      "title": "futex: Use correct exit on failure from futex_hash_allocate_default()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-39976",
    "datePublished": "2025-10-15T07:55:57.608Z",
    "dateReserved": "2025-04-16T07:20:57.150Z",
    "dateUpdated": "2026-08-05T12:06:45.033Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-39976",
      "date": "2026-10-02",
      "epss": "0.00144",
      "percentile": "0.03113"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "kernel/fork.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "f1635765cd0fdbf27b04d9a50be91a01b5adda13",
                    "status": "affected",
                    "version": "7c4f75a21f636486d2969d9b6680403ea8483539",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "4ec3c15462b9f44562f45723a92e2807746ba7d1",
                    "status": "affected",
                    "version": "7c4f75a21f636486d2969d9b6680403ea8483539",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "kernel/fork.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "6.16"
                  },
                  {
                    "lessThan": "6.16",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.16.*",
                    "status": "unaffected",
                    "version": "6.16.10",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "6.17",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nfutex: Use correct exit on failure from futex_hash_allocate_default()\n\ncopy_process() uses the wrong error exit path from futex_hash_allocate_default().\nAfter exiting from futex_hash_allocate_default(), neither tasklist_lock\nnor siglock has been acquired. The exit label bad_fork_core_free unlocks\nboth of these locks which is wrong.\n\nThe next exit label, bad_fork_cancel_cgroup, is the correct exit.\nsched_cgroup_fork() did not allocate any resources that need to freed.\n\nUse bad_fork_cancel_cgroup on error exit from futex_hash_allocate_default()."
          }
        ],
        "id": "CVE-2025-39976",
        "lastModified": "2026-07-30T06:24:03.563",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2025-10-15T08:15:35.400",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/4ec3c15462b9f44562f45723a92e2807746ba7d1"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/f1635765cd0fdbf27b04d9a50be91a01b5adda13"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Deferred"
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-07-30T08:54:00+00:00",
      "cve": "CVE-2025-39976",
      "id": "CVE-2025-39976",
      "initial_release_date": "2025-10-15T00:00:00+00:00",
      "product_status:known_affected": "14",
      "product_status:known_not_affected": "260",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: futex: Use correct exit on failure from futex_hash_allocate_default()",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-39976.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-08-31T00:18:13Z",
      "cve": "CVE-2025-39976",
      "id": "CVE-2025-39976",
      "initial_release_date": "2025-10-16T23:24:35Z",
      "product_status:known_not_affected": "523",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2025-39976",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2025-39976.json",
      "version": "8"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.