{"answers":{"affected":"It affects 2 products.","exploited":"There is no known exploitation of CVE-2025-39776 in the wild and no public exploit code.","fix":"Apply the vendor's patch.","what":"CVE-2025-39776 is a high-severity use after free vulnerability in Debian Debian Linux, published on 11 Sep 2025. It can only be exploited from the same machine or local network, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2025-39776 and fix it if it is affected.\n\nWhat it is: CVE-2025-39776 is a high-severity use after free vulnerability in Debian Debian Linux, published on 11 Sep 2025. It can only be exploited from the same machine or local network, with no action from the victim.\nExploitation: There is no known exploitation of CVE-2025-39776 in the wild and no public exploit code.\n\nAffected product: Debian Debian Linux. No package-level version data is available, so check the vendor advisory linked from the reference page.\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2025-39776/ (Markdown: https://insights.sbomify.com/CVE-2025-39776/index.md)","id":"CVE-2025-39776","markdown":"https://insights.sbomify.com/CVE-2025-39776/index.md","name":"CVE-2025-39776","record":{"aliases":["AZL-67247","AZL-74673","BELL-CVE-2025-39776","DEBIAN-CVE-2025-39776","GHSA-84v6-6vmq-3v62","ROOT-OS-UBUNTU-2204-CVE-2025-39776","ROOT-OS-UBUNTU-2404-CVE-2025-39776","UBUNTU-CVE-2025-39776"],"analysis":{"component_type":"kernel","fix_type":"patch","impacts":["denial_of_service"],"network_reachable":"adjacent_or_local","non_default_config":true,"product_category":"Linux kernel","requires_auth":"low_privilege","summary":"A use-after-free in the Linux kernel debug VM pgtable test can cause stale entries and kernel warnings, requiring CONFIG_DEBUG_VM_PGTABLE enabled.","user_interaction":"not_required","vuln_class":"use_after_free"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"Linux","cpe":[{"product":"debian_linux","vendor":"debian"},{"product":"linux_kernel","vendor":"linux"}],"cvss":{"score":7,"severity":"high","source":"cna","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"cwes":[{"id":"CWE-416","name":"Use After Free"}],"description":"In the Linux kernel, the following vulnerability has been resolved:\n\nmm/debug_vm_pgtable: clear page table entries at destroy_args()\n\nThe mm/debug_vm_pagetable test allocates manually page table entries for\nthe tests it runs, using also its manually allocated mm_struct.  That in\nitself is ok, but when it exits, at destroy_args() it fails to clear those\nentries with the *_clear functions.\n\nThe problem is that leaves stale entries.  If another process allocates an\nmm_struct with a pgd at the same address, it may end up running into the\nstale entry.  This is happening in practice on a debug kernel with\nCONFIG_DEBUG_VM_PGTABLE=y, for example this is the output with some extra\ndebugging I added (it prints a warning trace if pgtables_bytes goes\nnegative, in addition to the warning at check_mm() function):\n\n[    2.539353] debug_vm_pgtable: [get_random_vaddr         ]: random_vaddr is 0x7ea247140000\n[    2.539366] kmem_cache info\n[    2.539374] kmem_cachep 0x000000002ce82385 - freelist 0x0000000000000000 - offset 0x508\n[    2.539447] debug_vm_pgtable: [init_args                ]: args-\u003emm is 0x000000002267cc9e\n(...)\n[    2.552800] WARNING: CPU: 5 PID: 116 at include/linux/mm.h:2841 free_pud_range+0x8bc/0x8d0\n[    2.552816] Modules linked in:\n[    2.552843] CPU: 5 UID: 0 PID: 116 Comm: modprobe Not tainted 6.12.0-105.debug_vm2.el10.ppc64le+debug #1 VOLUNTARY\n[    2.552859] Hardware name: IBM,9009-41A POWER9 (architected) 0x4e0202 0xf000005 of:IBM,FW910.00 (VL910_062) hv:phyp pSeries\n[    2.552872] NIP:  c0000000007eef3c LR: c0000000007eef30 CTR: c0000000003d8c90\n[    2.552885] REGS: c0000000622e73b0 TRAP: 0700   Not tainted  (6.12.0-105.debug_vm2.el10.ppc64le+debug)\n[    2.552899] MSR:  800000000282b033 \u003cSF,VEC,VSX,EE,FP,ME,IR,DR,RI,LE\u003e  CR: 24002822  XER: 0000000a\n[    2.552954] CFAR: c0000000008f03f0 IRQMASK: 0\n[    2.552954] GPR00: c0000000007eef30 c0000000622e7650 c000000002b1ac00 0000000000000001\n[    2.552954] GPR04: 0000000000000008 0000000000000000 c0000000007eef30 ffffffffffffffff\n[    2.552954] GPR08: 00000000ffff00f5 0000000000000001 0000000000000048 0000000000004000\n[    2.552954] GPR12: 00000003fa440000 c000000017ffa300 c0000000051d9f80 ffffffffffffffdb\n[    2.552954] GPR16: 0000000000000000 0000000000000008 000000000000000a 60000000000000e0\n[    2.552954] GPR20: 4080000000000000 c0000000113af038 00007fffcf130000 0000700000000000\n[    2.552954] GPR24: c000000062a6a000 0000000000000001 8000000062a68000 0000000000000001\n[    2.552954] GPR28: 000000000000000a c000000062ebc600 0000000000002000 c000000062ebc760\n[    2.553170] NIP [c0000000007eef3c] free_pud_range+0x8bc/0x8d0\n[    2.553185] LR [c0000000007eef30] free_pud_range+0x8b0/0x8d0\n[    2.553199] Call Trace:\n[    2.553207] [c0000000622e7650] [c0000000007eef30] free_pud_range+0x8b0/0x8d0 (unreliable)\n[    2.553229] [c0000000622e7750] [c0000000007f40b4] free_pgd_range+0x284/0x3b0\n[    2.553248] [c0000000622e7800] [c0000000007f4630] free_pgtables+0x450/0x570\n[    2.553274] [c0000000622e78e0] [c0000000008161c0] exit_mmap+0x250/0x650\n[    2.553292] [c0000000622e7a30] [c0000000001b95b8] __mmput+0x98/0x290\n[    2.558344] [c0000000622e7a80] [c0000000001d1018] exit_mm+0x118/0x1b0\n[    2.558361] [c0000000622e7ac0] [c0000000001d141c] do_exit+0x2ec/0x870\n[    2.558376] [c0000000622e7b60] [c0000000001d1ca8] do_group_exit+0x88/0x150\n[    2.558391] [c0000000622e7bb0] [c0000000001d1db8] sys_exit_group+0x48/0x50\n[    2.558407] [c0000000622e7be0] [c00000000003d810] system_call_exception+0x1e0/0x4c0\n[    2.558423] [c0000000622e7e50] [c00000000000d05c] system_call_vectored_common+0x15c/0x2ec\n(...)\n[    2.558892] ---[ end trace 0000000000000000 ]---\n[    2.559022] BUG: Bad rss-counter state mm:000000002267cc9e type:MM_ANONPAGES val:1\n[    2.559037] BUG: non-zero pgtables_bytes on freeing mm: -6144\n\nHere the modprobe process ended up with an allocated mm_struct from the\nmm_struct slab that was used before by the debug_vm_pgtable test.  That is\nnot a problem, since the mm_stru\n---truncated---","ecosystems":[],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":true,"headline":"mm/debug_vm_pgtable: clear page table entries at destroy_args()","id":"CVE-2025-39776","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":null,"product":"debian:debian_linux","products":["debian:debian_linux","linux:linux_kernel"],"type":"use_after_free","year":"2025"},"n_packages":0,"n_references":6,"next":{"headline":"crypto: acomp - Fix CFI failure due to type punning","id":"CVE-2025-39777"},"packages":[],"prev":{"headline":"mm/mremap: fix WARN with uffd that has remap events disabled","id":"CVE-2025-39775"},"products":["Linux"],"published":"2025-09-11","related":[{"cvss_score":10,"headline":"ProFTPD Improper Access Control","id":"CVE-2015-3306","kev_date_added":"2026-10-08","published":"2015-05-18"},{"cvss_score":9.9,"headline":"RoundCube Webmail Deserialization of Untrusted Data","id":"CVE-2025-49113","kev_date_added":"2026-02-20","published":"2025-06-02"},{"cvss_score":9.8,"headline":"GNU InetUtils Argument Injection","id":"CVE-2026-24061","kev_date_added":"2026-01-26","published":"2026-01-21"},{"cvss_score":9.8,"headline":"Linux Kernel Improper Check for Unusual or Exceptional Conditions","id":"CVE-2025-39682","kev_date_added":"2026-09-18","published":"2025-09-05"},{"cvss_score":9.8,"headline":"Mozilla Firefox Use-After-Free","id":"CVE-2024-9680","kev_date_added":"2024-10-15","published":"2024-10-09"},{"cvss_score":9.8,"headline":"RARLAB UnRAR Directory Traversal","id":"CVE-2022-30333","kev_date_added":"2022-08-09","published":"2022-05-09"},{"cvss_score":9.8,"headline":"Roundcube Webmail SQL Injection","id":"CVE-2021-44026","kev_date_added":"2023-06-22","published":"2021-11-19"}],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"US public information, NVD API terms","name":"NVD"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":"no","exploitation":"none","technical_impact":"total"},"state":"PUBLISHED","updated":"2026-10-15","vendors":["Linux"]},"summary":"A use-after-free in the Linux kernel debug VM pgtable test can cause stale entries and kernel warnings, requiring CONFIG_DEBUG_VM_PGTABLE enabled.","url":"https://insights.sbomify.com/CVE-2025-39776/"}