CVE-2025-39877 – A use-after-free vulnerability in the Linux ker... (How to Fix)

Q: What is the severity of CVE-2025-39877?

CVE-2025-39877 has a CVSS score of 7.8 (HIGH). A use-after-free vulnerability in the Linux kernel's DAMON sysfs interface allows race conditions where freed memory is accessed. This can lead to kernel crashes or potential privilege escalation. Affects Linux systems with DAMON enabled and kernel versions containing the vulnerable code.

📋 TL;DR

A use-after-free vulnerability in the Linux kernel's DAMON sysfs interface allows race conditions where freed memory is accessed. This can lead to kernel crashes or potential privilege escalation. Affects Linux systems with DAMON enabled and kernel versions containing the vulnerable code.

💻 Affected Systems

Products:

Linux kernel

Versions: Kernel versions from when state_show() first accessed kdamond->damon_ctx (introduced in DAMON sysfs support) up to patched versions

Operating Systems: Linux distributions using affected kernel versions

Default Config Vulnerable: ✅ No

Notes: Only vulnerable if DAMON (Data Access MONitor) is enabled and being used. Many distributions don't enable DAMON by default.

📦 What is this software?

Debian Linux by Debian

View all CVEs affecting Debian Linux →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Kernel panic leading to system crash, or potential privilege escalation to root if an attacker can control the freed memory region.

🟠

Likely Case

Kernel crash or system instability when DAMON operations are performed concurrently with state monitoring.

🟢

If Mitigated

Minor performance impact or system instability if DAMON is disabled or not in use.

🌐 Internet-Facing: LOW - Requires local access to the sysfs interface, not directly exploitable over network.

🏢 Internal Only: MEDIUM - Requires local user access, but could be exploited by malicious users or compromised accounts on the system.

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: UNKNOWN

Unauthenticated Exploit: ✅ No

Complexity: MEDIUM

Requires local access and ability to trigger the race condition between state_show() and context destruction operations.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Patched in kernel commits: 26d29b2ac87a2989071755f9828ebf839b560d4c, 3260a3f0828e06f5f13fac69fb1999a6d60d9cff, 3858c44341ad49dc7544b19cc9f9ecffaa7cc50e, 4e87f461d61959647464a94d11ae15c011be58ce, 60d7a3d2b985a395318faa1d88da6915fad11c19

Vendor Advisory: https://git.kernel.org/stable/c/26d29b2ac87a2989071755f9828ebf839b560d4c

Restart Required: Yes

Instructions:

1. Update to a kernel version containing the fix. 2. Check your distribution's security advisories for backported patches. 3. Reboot the system after kernel update.

🔧 Temporary Workarounds

Disable DAMON

linux

Disable the DAMON feature if not required

echo 'blacklist damon' >> /etc/modprobe.d/blacklist.conf
reboot

🧯 If You Can't Patch

Restrict access to /sys/kernel/mm/damon/ to root only
Monitor for kernel panic logs and system instability

🔍 How to Verify

Check if Vulnerable:

Check if DAMON is enabled: lsmod | grep damon, and check kernel version against affected range

Check Version:

uname -r

Verify Fix Applied:

Verify kernel version includes the fix commits or is newer than patched versions

📡 Detection & Monitoring

Log Indicators:

Kernel panic messages
Use-after-free warnings in kernel logs
System crashes when DAMON operations are performed

Network Indicators:

None - local vulnerability only

SIEM Query:

source="kernel" AND ("panic" OR "use-after-free" OR "BUG") AND "damon"

📊 Metadata

CVE ID: CVE-2025-39877

CVSS v3 Score: 7.8 (HIGH)

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE: CWE-416

EPSS Score: 0.02% exploit probability (5.6th percentile)

Published: September 23, 2025

Last Updated: January 20, 2026

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2025-39877, you might also want to check these: