Use-After-Free Vulnerability in Linux Kernel Affects Multiple Configurations

CVE-2025-39877

What is CVE-2025-39877?

A use-after-free vulnerability exists in the Linux kernel's handling of the state_show() function, specifically in its interaction with the kdamond->damon_ctx. When state_show() accesses this context without proper locking through damon_sysfs_lock, a race condition can occur, leading to potential exploitation and system instability. The context may be freed by another CPU while being accessed, resulting in undefined behavior and security risks. This issue has been present since the initial implementation of state_show() and has been rectified by enforcing proper locking mechanisms before dereferencing the context, ensuring that the integrity of the system is maintained.

References