CVE-2025-39913

Q: What is the severity of CVE-2025-39913?

CVE-2025-39913 has a CVSS score of 7.8 (HIGH). A memory management vulnerability in the Linux kernel's TCP BPF subsystem where failure to allocate memory for corked data doesn't properly clean up socket resources, leading to a use-after-free condition. This affects systems using SOCKMAP with BPF programs that call bpf_msg_cork_bytes().

7.8 HIGH

Denial of Service

📋 TL;DR

A memory management vulnerability in the Linux kernel's TCP BPF subsystem where failure to allocate memory for corked data doesn't properly clean up socket resources, leading to a use-after-free condition. This affects systems using SOCKMAP with BPF programs that call bpf_msg_cork_bytes().

💻 Affected Systems

Products:

Linux kernel

Versions: Specific affected versions not explicitly stated in CVE, but patches available for multiple stable branches

Operating Systems: Linux distributions using affected kernel versions

Default Config Vulnerable: ✅ No

Notes: Requires: 1) BPF programs using bpf_msg_cork_bytes() 2) SOCKMAP configuration 3) Fault injection or memory pressure conditions

📦 What is this software?

Debian Linux by Debian

View all CVEs affecting Debian Linux →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Kernel panic leading to system crash and denial of service, potentially allowing privilege escalation if combined with other vulnerabilities.

🟠

Likely Case

System crash or kernel panic causing denial of service on affected systems.

🟢

If Mitigated

No impact if the vulnerable code path isn't triggered (requires specific BPF program configuration).

🌐 Internet-Facing: MEDIUM - Requires specific BPF program configuration and fault injection conditions.

🏢 Internal Only: MEDIUM - Same technical requirements as internet-facing, but internal systems may have more controlled configurations.

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: UNKNOWN

Unauthenticated Exploit: ✅ No

Complexity: HIGH

Exploitation requires specific BPF program configuration and memory allocation failure conditions. Found via syzbot fuzzing.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Multiple stable kernel versions with commits: 05366527f44c, 08f58d10f5ab, 539920180c55, 66bcb04a441f, 7429b8b9bfbc

Vendor Advisory: https://git.kernel.org/stable/c/05366527f44cf4b884f3d9462ae8009be9665856

Restart Required: Yes

Instructions:

1. Update Linux kernel to patched version 2. Reboot system 3. Verify kernel version matches patched release

🔧 Temporary Workarounds

Disable BPF SOCKMAP functionality

linux

Prevent use of vulnerable code path by disabling SOCKMAP BPF programs

sysctl -w net.core.bpf_jit_enable=0
Remove or disable BPF programs using bpf_msg_cork_bytes()

🧯 If You Can't Patch

Disable BPF programs using bpf_msg_cork_bytes() function
Implement memory pressure monitoring and alerting to detect conditions that could trigger the vulnerability

🔍 How to Verify

Check if Vulnerable:

Check if system has BPF programs using bpf_msg_cork_bytes() attached to SOCKMAP: bpftool prog list | grep -i cork

Check Version:

uname -r

Verify Fix Applied:

Check kernel version against patched releases and verify no kernel panics occur during memory pressure tests with BPF programs

📡 Detection & Monitoring

Log Indicators:

Kernel panic logs mentioning inet_sock_destruct
Warnings about memory allocation failures in TCP BPF context
System crash/reboot events

Network Indicators:

Sudden termination of TCP connections using BPF acceleration

SIEM Query:

event.category:kernel AND (message:*inet_sock_destruct* OR message:*tcp_bpf* AND message:*allocation*failed*)

📊 Metadata

CVE ID: CVE-2025-39913

CVSS v3 Score: 7.8 (HIGH)

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS Score: 0.03% exploit probability (6.9th percentile)

Published: October 1, 2025

Last Updated: January 16, 2026

📋 TL;DR

💻 Affected Systems

📦 What is this software?

Debian Linux by Debian

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

⚠️ Risk & Real-World Impact

Worst Case

Likely Case

If Mitigated

🎯 Exploit Status

🛠️ Fix & Mitigation

✅ Official Fix

Instructions:

🔧 Temporary Workarounds

Disable BPF SOCKMAP functionality

🧯 If You Can't Patch

🔍 How to Verify

Check if Vulnerable:

Check Version:

Verify Fix Applied:

📡 Detection & Monitoring

Log Indicators:

Network Indicators:

SIEM Query:

📊 Metadata

🔗 References

📤 Share & Export