SECUFOCUSNOW
Home›CVE index›CVE-2025-39966
Review reviewHigh

CVE-2025-39966

Linux Linux, linux kernel

In the Linux kernel, the following vulnerability has been resolved: iommufd: Fix race during abort for file descriptors fput() doesn't actually call file_operations release() synchronously, it puts the file on a work queue and it will be released eventually. This is normally fine, except for iommufd the file and the iommufd_object are tied to gether. The file has the object as it's private_data and holds a users refcount, while the object is expected to remain alive as long as the file is. When the allocation of a new object aborts before installing the file it will fput() the file and then...

CVSS
7
EPSS
-
- percentile
CISA KEV
Not listed
Published
2025.10.15
PRIORITY ASSESSMENT

Review review

The CVSS severity warrants an early asset and exposure review.

Known exploitationNot established by KEV
Exploit probability-
Technical severityCVSS 7

Vulnerability overview

In the Linux kernel, the following vulnerability has been resolved: iommufd: Fix race during abort for file descriptors fput() doesn't actually call file_operations release() synchronously, it puts the file on a work queue and it will be released eventually. This is normally fine, except for iommufd the file and the iommufd_object are tied to gether. The file has the object as it's private_data and holds a users refcount, while the object is expected to remain alive as long as the file is. When the allocation of a new object aborts before installing the file it will fput() the file and then...

Affected product and versions

Product
Linux Linux, linux kernel
Affected versions
>= 07838f7fd529c8a6de44b601d4b7057e6c8d36ed < 17195a7d754a5c6a31888702ca93f6f08f3383ad, >= 07838f7fd529c8a6de44b601d4b7057e6c8d36ed < e4825368285e33d6360c6c6a6a10d2d83da06e55, >= 07838f7fd529c8a6de44b601d4b7057e6c8d36ed < 4e034bf045b12852a24d5d33f2451850818ba0c1, >= 6.11, >= 6.11 < 6.12.50, >= 6.13 < 6.16.10, 6.17
Fixed versions
6.12.50, 6.16.10

Recommended response sequence

Confirm exposure before applying a vendor-supported change.

Full remediation guide
  1. 1
    Identify

    Confirm that Linux Linux, linux kernel and an affected version are present.

  2. 2
    Prioritize

    Combine exploitation signals with asset exposure and business criticality.

  3. 3
    Remediate

    Follow the vendor advisory or supported update path and preserve rollback options.

  4. 4
    Verify

    Recheck the version, service health, access paths, and relevant logs.

Technical data

CVSS vector
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE
CWE-362