CVE-2025-39900
- Source
- https://nvd.nist.gov/vuln/detail/CVE-2025-39900
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-39900.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2025-39900
- Downstream
- Related
- Published
- 2025-10-01T07:42:47Z
- Modified
- 2025-10-22T16:38:32.620045Z
- Summary
- net_sched: gen_estimator: fix est_timer() vs CONFIG_PREEMPT_RT=y
- Details
-
In the Linux kernel, the following vulnerability has been resolved:
netsched: genestimator: fix esttimer() vs CONFIGPREEMPT_RT=y
syzbot reported a WARNING in est_timer() [1]
Problem here is that with CONFIGPREEMPTRT=y, timer callbacks can be preempted.
Adopt preemptdisablenested()/preemptenablenested() to fix this.
[1] WARNING: CPU: 0 PID: 16 at ./include/linux/seqlock.h:221 seqpropassert include/linux/seqlock.h:221 [inline] WARNING: CPU: 0 PID: 16 at ./include/linux/seqlock.h:221 esttimer+0x6dc/0x9f0 net/core/genestimator.c:93 Modules linked in: CPU: 0 UID: 0 PID: 16 Comm: ktimers/0 Not tainted syzkaller #0 PREEMPT{RT,(full)} Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 RIP: 0010:seqpropassert include/linux/seqlock.h:221 [inline] RIP: 0010:esttimer+0x6dc/0x9f0 net/core/genestimator.c:93 Call Trace: <TASK> calltimerfn+0x17e/0x5f0 kernel/time/timer.c:1747 expiretimers kernel/time/timer.c:1798 [inline] _runtimers kernel/time/timer.c:2372 [inline] _runtimerbase+0x648/0x970 kernel/time/timer.c:2384 runtimerbase kernel/time/timer.c:2393 [inline] runtimersoftirq+0xb7/0x180 kernel/time/timer.c:2403 handlesoftirqs+0x22c/0x710 kernel/softirq.c:579 _dosoftirq kernel/softirq.c:613 [inline] runktimerd+0xcf/0x190 kernel/softirq.c:1043 smpbootthreadfn+0x53f/0xa60 kernel/smpboot.c:160 kthread+0x70e/0x8a0 kernel/kthread.c:463 retfromfork+0x3fc/0x770 arch/x86/kernel/process.c:148 retfromforkasm+0x1a/0x30 arch/x86/entry/entry_64.S:245 </TASK>
- References
Affected packages
Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Affected ranges
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introducedd2d6422f8bd17c6bb205133e290625a564194496Fixeda22ec2ee824be30803068a52f78f7ffe3bc879fb
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introducedd2d6422f8bd17c6bb205133e290625a564194496Fixede79923824c48b930609680be04cb29253fc4a17d
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introducedd2d6422f8bd17c6bb205133e290625a564194496Fixed9f74c0ea9b26d1505d55b61e36b1623dd347e1d1