Use-After-Free Vulnerability in Linux Kernel Kernfs Component

CVE-2025-39881

What is CVE-2025-39881?

A use-after-free vulnerability was discovered in the Linux kernel's kernfs component, affecting the polling mechanism utilized by the Pressure Stall Information (PSI). This issue arises when an open file is released while still being referenced by ongoing polling operations. Specifically, during a race condition, disabling PSI monitoring frees the associated resources, potentially leading to access of freed memory upon re-enabling monitoring. This can introduce instability and unexpected behavior in systems relying on PSI for resource management. The vulnerability has been addressed by implementing a new function to properly manage open file references, ensuring that operations are not attempted on released descriptors.

References