{"answers":{"affected":"It affects 1 product.","exploited":"There is no known exploitation of CVE-2025-39886 in the wild and no public exploit code.","fix":"Apply the vendor's patch.","what":"CVE-2025-39886 is a medium-severity denial of service vulnerability in Linux kernel, published on 23 Sep 2025. It can only be exploited from the same machine or local network, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2025-39886 and fix it if it is affected.\n\nWhat it is: CVE-2025-39886 is a medium-severity denial of service vulnerability in Linux kernel, published on 23 Sep 2025. It can only be exploited from the same machine or local network, with no action from the victim.\nExploitation: There is no known exploitation of CVE-2025-39886 in the wild and no public exploit code.\n\nAffected product: Linux kernel. No package-level version data is available, so check the vendor advisory linked from the reference page.\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2025-39886/ (Markdown: https://insights.sbomify.com/CVE-2025-39886/index.md)","id":"CVE-2025-39886","markdown":"https://insights.sbomify.com/CVE-2025-39886/index.md","name":"CVE-2025-39886","record":{"aliases":["AZL-67643","AZL-72352","BELL-CVE-2025-39886","DEBIAN-CVE-2025-39886","GHSA-6wfv-64f3-9h2q","ROOT-OS-DEBIAN-12-CVE-2025-39886","ROOT-OS-UBUNTU-2204-CVE-2025-39886","ROOT-OS-UBUNTU-2404-CVE-2025-39886","UBUNTU-CVE-2025-39886"],"analysis":{"component_type":"kernel","fix_type":"patch","impacts":["denial_of_service"],"network_reachable":"adjacent_or_local","non_default_config":false,"product_category":"Linux kernel BPF","requires_auth":"low_privilege","summary":"A locking issue in the Linux kernel BPF timer initialization can cause a hardlockup, leading to a denial of service.","user_interaction":"not_required","vuln_class":"denial_of_service"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"Linux","cpe":[{"product":"linux_kernel","vendor":"linux"}],"cvss":{"score":5.5,"severity":"medium","source":"cisa-adp","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"cwes":[],"description":"In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Tell memcg to use allow_spinning=false path in bpf_timer_init()\n\nCurrently, calling bpf_map_kmalloc_node() from __bpf_async_init() can\ncause various locking issues; see the following stack trace (edited for\nstyle) as one example:\n\n...\n [10.011566]  do_raw_spin_lock.cold\n [10.011570]  try_to_wake_up             (5) double-acquiring the same\n [10.011575]  kick_pool                      rq_lock, causing a hardlockup\n [10.011579]  __queue_work\n [10.011582]  queue_work_on\n [10.011585]  kernfs_notify\n [10.011589]  cgroup_file_notify\n [10.011593]  try_charge_memcg           (4) memcg accounting raises an\n [10.011597]  obj_cgroup_charge_pages        MEMCG_MAX event\n [10.011599]  obj_cgroup_charge_account\n [10.011600]  __memcg_slab_post_alloc_hook\n [10.011603]  __kmalloc_node_noprof\n...\n [10.011611]  bpf_map_kmalloc_node\n [10.011612]  __bpf_async_init\n [10.011615]  bpf_timer_init             (3) BPF calls bpf_timer_init()\n [10.011617]  bpf_prog_xxxxxxxxxxxxxxxx_fcg_runnable\n [10.011619]  bpf__sched_ext_ops_runnable\n [10.011620]  enqueue_task_scx           (2) BPF runs with rq_lock held\n [10.011622]  enqueue_task\n [10.011626]  ttwu_do_activate\n [10.011629]  sched_ttwu_pending         (1) grabs rq_lock\n...\n\nThe above was reproduced on bpf-next (b338cf849ec8) by modifying\n./tools/sched_ext/scx_flatcg.bpf.c to call bpf_timer_init() during\nops.runnable(), and hacking the memcg accounting code a bit to make\na bpf_timer_init() call more likely to raise an MEMCG_MAX event.\n\nWe have also run into other similar variants (both internally and on\nbpf-next), including double-acquiring cgroup_file_kn_lock, the same\nworker_pool::lock, etc.\n\nAs suggested by Shakeel, fix this by using __GFP_HIGH instead of\nGFP_ATOMIC in __bpf_async_init(), so that e.g. if try_charge_memcg()\nraises an MEMCG_MAX event, we call __memcg_memory_event() with\n@allow_spinning=false and avoid calling cgroup_file_notify() there.\n\nDepends on mm patch\n\"memcg: skip cgroup_file_notify if spinning is not allowed\":\nhttps://lore.kernel.org/bpf/20250905201606.66198-1-shakeel.butt@linux.dev/\n\nv0 approach s/bpf_map_kmalloc_node/bpf_mem_alloc/\nhttps://lore.kernel.org/bpf/20250905061919.439648-1-yepeilin@google.com/\nv1 approach:\nhttps://lore.kernel.org/bpf/20250905234547.862249-1-yepeilin@google.com/","ecosystems":[],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":true,"headline":"bpf: Tell memcg to use allow_spinning=false path in bpf_timer_init()","id":"CVE-2025-39886","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":null,"product":"linux:linux_kernel","products":["linux:linux_kernel"],"type":"denial_of_service","year":"2025"},"n_packages":0,"n_references":4,"next":{"headline":"tracing/osnoise: Fix null-ptr-deref in bitmap_parselist()","id":"CVE-2025-39887"},"packages":[],"prev":{"headline":"ocfs2: fix recursive semaphore deadlock in fiemap call","id":"CVE-2025-39885"},"products":["Linux"],"published":"2025-09-23","related":[{"cvss_score":8.8,"headline":"Linux Kernel Out-of-Bounds Write","id":"CVE-2026-53266","kev_date_added":"2026-09-18","published":"2026-06-25"},{"cvss_score":8.8,"headline":"Linux Kernel Improper Input Validation","id":"CVE-2013-6282","kev_date_added":"2022-09-15","published":"2013-11-19"},{"cvss_score":8.4,"headline":"Linux Kernel Heap-Based Buffer Overflow","id":"CVE-2022-0185","kev_date_added":"2024-08-21","published":"2022-02-11"},{"cvss_score":8.4,"headline":"Linux Kernel Privilege Escalation","id":"CVE-2013-2094","kev_date_added":"2022-09-15","published":"2013-05-14"},{"cvss_score":7.8,"headline":"Linux Kernel Unspecified","id":"CVE-2026-53362","kev_date_added":"2026-08-27","published":"2026-07-04"},{"cvss_score":7.8,"headline":"Linux Kernel Missing Initialization of a Variable","id":"CVE-2026-46300","kev_date_added":"2026-10-28","published":"2026-05-23"},{"cvss_score":7.8,"headline":"Linux Kernel Race Condition","id":"CVE-2025-39964","kev_date_added":"2026-09-18","published":"2025-10-13"}],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"US public information, NVD API terms","name":"NVD"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":"no","exploitation":"none","technical_impact":"partial"},"state":"PUBLISHED","updated":"2026-05-11","vendors":["Linux"]},"summary":"A locking issue in the Linux kernel BPF timer initialization can cause a hardlockup, leading to a denial of service.","url":"https://insights.sbomify.com/CVE-2025-39886/"}