CVE-2025-39977 futex: Prevent use-after-free during requeue-PI
A race condition in the Linux kernel futex subsystem allows a use-after-free, potentially enabling local attackers to execute arbitrary code or escalate privileges.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-39977?
CVE-2025-39977 is a high-severity use after free vulnerability in Linux, published on 15 Oct 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
futex: Prevent use-after-free during requeue-PI
syzbot managed to trigger the following race:
T1 T2
futex_wait_requeue_pi() futex_do_wait() schedule() futex_requeue() futex_proxy_trylock_atomic() futex_requeue_pi_prepare() requeue_pi_wake_futex() futex_requeue_pi_complete() /* preempt */
* timeout/ signal wakes T1 *
futex_requeue_pi_wakeup_sync() // Q_REQUEUE_PI_LOCKED futex_hash_put() // back to userland, on stack futex_q is garbage
/* back */ wake_up_state(q->task, TASK_NORMAL);
In this scenario futex_wait_requeue_pi() is able to leave without using futex_q::lock_ptr for synchronization.
This can be prevented by reading futex_q::task before updating the futex_q::requeue_state. A reference on the task_struct is not needed because requeue_pi_wake_futex() is invoked with a spinlock_t held which implies a RCU read section.
Even if T1 terminates immediately after, the task_struct will remain valid during T2's wake_up_state(). A READ_ONCE on futex_q::task before futex_requeue_pi_complete() is enough because it ensures that the variable is read before the state is updated.
Read futex_q::task before updating the requeue state, use it for the following wakeup.
Which versions are affected by CVE-2025-39977?
How do I fix CVE-2025-39977?
Apply the vendor's patch.
Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.
Is CVE-2025-39977 being exploited?
There is no known exploitation of CVE-2025-39977 in the wild and no public exploit code.
Sources
Also known as AZL-68525, BELL-CVE-2025-39977, DEBIAN-CVE-2025-39977, GHSA-56h7-2ch6-v472, ROOT-OS-DEBIAN-12-CVE-2025-39977, ROOT-OS-DEBIAN-13-CVE-2025-39977 and 3 more.