Use-after-free in Linux kernel - CVE-2025-39966

Vulnerability identifier: #VU117264

CSH Severity: Low

CVSS v4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2025-39966

CWE-ID: CWE-416

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the iommufd_object_abort() and iommufd_ctx_put() functions in drivers/iommu/iommufd/main.c. A local user can escalate privileges on the system.

Linux kernel
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for ARM 64
kernel (Red Hat package)
kernel-rt-64k-modules (Red Hat package)
kernel-64k-devel-matched (Red Hat package)
kernel-rt-64k-devel (Red Hat package)
kernel-rt-64k-debug-modules-extra (Red Hat package)
kernel-rt-64k-debug-modules-core (Red Hat package)
kernel-rt-64k-debug-modules (Red Hat package)
kernel-rt-64k-debug-devel (Red Hat package)
kernel-rt-64k-debug-core (Red Hat package)
kernel-rt-64k-debug (Red Hat package)
kernel-rt-64k-core (Red Hat package)
kernel-rt-64k (Red Hat package)
kernel-rt (Red Hat package)
libperf (Red Hat package)
kernel-tools-libs-devel (Red Hat package)
kernel-cross-headers (Red Hat package)
kernel-debug (Red Hat package)
kernel-rt-64k-modules-core (Red Hat package)
kernel-rt-64k-modules-extra (Red Hat package)
kernel-rt-core (Red Hat package)
kernel-rt-debug (Red Hat package)
kernel-rt-debug-core (Red Hat package)
kernel-rt-debug-devel (Red Hat package)
kernel-rt-debug-modules (Red Hat package)
kernel-rt-debug-modules-core (Red Hat package)
kernel-rt-debug-modules-extra (Red Hat package)
kernel-rt-devel (Red Hat package)
kernel-rt-modules (Red Hat package)
kernel-rt-modules-core (Red Hat package)
kernel-rt-modules-extra (Red Hat package)
kernel-rt-debug-kvm (Red Hat package)
kernel-rt-kvm (Red Hat package)
kernel-64k-debug-devel-matched (Red Hat package)
kernel-debug-core (Red Hat package)
kernel-debug-devel (Red Hat package)
kernel-debug-devel-matched (Red Hat package)
kernel-debug-modules (Red Hat package)
kernel-debug-modules-core (Red Hat package)
kernel-debug-modules-extra (Red Hat package)
kernel-debug-uki-virt (Red Hat package)
kernel-devel (Red Hat package)
kernel-devel-matched (Red Hat package)
kernel-headers (Red Hat package)
kernel-modules (Red Hat package)
kernel-modules-core (Red Hat package)
kernel-modules-extra (Red Hat package)
kernel-tools (Red Hat package)
kernel-tools-libs (Red Hat package)
kernel-uki-virt (Red Hat package)
kernel-uki-virt-addons (Red Hat package)
perf (Red Hat package)
python3-perf (Red Hat package)
rtla (Red Hat package)
rv (Red Hat package)
kernel-zfcpdump (Red Hat package)
kernel-zfcpdump-core (Red Hat package)
kernel-zfcpdump-devel (Red Hat package)
kernel-zfcpdump-devel-matched (Red Hat package)
kernel-zfcpdump-modules (Red Hat package)
kernel-zfcpdump-modules-core (Red Hat package)
kernel-zfcpdump-modules-extra (Red Hat package)
kernel-64k-debug-devel (Red Hat package)
kernel-64k-devel (Red Hat package)

Install update from vendor's repository.

kernel (Red Hat package) - addressed in versions 5.14.0-570.72.1.el9_6, 6.12.0-124.27.1.el10_1
kernel-rt-64k-modules (Red Hat package) - update to 6.12.0-55.50.1.el10_0
kernel-64k-devel-matched (Red Hat package) - update to 6.12.0-55.50.1.el10_0
kernel-rt-64k-devel (Red Hat package) - update to 6.12.0-55.50.1.el10_0
kernel-rt-64k-debug-modules-extra (Red Hat package) - update to 6.12.0-55.50.1.el10_0
kernel-rt-64k-debug-modules-core (Red Hat package) - update to 6.12.0-55.50.1.el10_0
kernel-rt-64k-debug-modules (Red Hat package) - update to 6.12.0-55.50.1.el10_0
kernel-rt-64k-debug-devel (Red Hat package) - update to 6.12.0-55.50.1.el10_0
kernel-rt-64k-debug-core (Red Hat package) - update to 6.12.0-55.50.1.el10_0
kernel-rt-64k-debug (Red Hat package) - update to 6.12.0-55.50.1.el10_0
kernel-rt-64k-core (Red Hat package) - update to 6.12.0-55.50.1.el10_0
kernel-rt-64k (Red Hat package) - update to 6.12.0-55.50.1.el10_0
kernel-rt (Red Hat package) - update to 6.12.0-55.50.1.el10_0
libperf (Red Hat package) - update to 6.12.0-55.50.1.el10_0
kernel-tools-libs-devel (Red Hat package) - update to 6.12.0-55.50.1.el10_0
kernel-cross-headers (Red Hat package) - update to 6.12.0-55.50.1.el10_0
kernel-debug (Red Hat package) - update to 6.12.0-55.50.1.el10_0
kernel-rt-64k-modules-core (Red Hat package) - update to 6.12.0-55.50.1.el10_0
kernel-rt-64k-modules-extra (Red Hat package) - update to 6.12.0-55.50.1.el10_0
kernel-rt-core (Red Hat package) - update to 6.12.0-55.50.1.el10_0
kernel-rt-debug (Red Hat package) - update to 6.12.0-55.50.1.el10_0
kernel-rt-debug-core (Red Hat package) - update to 6.12.0-55.50.1.el10_0
kernel-rt-debug-devel (Red Hat package) - update to 6.12.0-55.50.1.el10_0
kernel-rt-debug-modules (Red Hat package) - update to 6.12.0-55.50.1.el10_0
kernel-rt-debug-modules-core (Red Hat package) - update to 6.12.0-55.50.1.el10_0
kernel-rt-debug-modules-extra (Red Hat package) - update to 6.12.0-55.50.1.el10_0
kernel-rt-devel (Red Hat package) - update to 6.12.0-55.50.1.el10_0
kernel-rt-modules (Red Hat package) - update to 6.12.0-55.50.1.el10_0
kernel-rt-modules-core (Red Hat package) - update to 6.12.0-55.50.1.el10_0
kernel-rt-modules-extra (Red Hat package) - update to 6.12.0-55.50.1.el10_0
kernel-rt-debug-kvm (Red Hat package) - update to 6.12.0-55.50.1.el10_0
kernel-rt-kvm (Red Hat package) - update to 6.12.0-55.50.1.el10_0
kernel-64k-debug-devel-matched (Red Hat package) - update to 6.12.0-55.50.1.el10_0
kernel-debug-core (Red Hat package) - update to 6.12.0-55.50.1.el10_0
kernel-debug-devel (Red Hat package) - update to 6.12.0-55.50.1.el10_0
kernel-debug-devel-matched (Red Hat package) - update to 6.12.0-55.50.1.el10_0
kernel-debug-modules (Red Hat package) - update to 6.12.0-55.50.1.el10_0
kernel-debug-modules-core (Red Hat package) - update to 6.12.0-55.50.1.el10_0
kernel-debug-modules-extra (Red Hat package) - update to 6.12.0-55.50.1.el10_0
kernel-debug-uki-virt (Red Hat package) - update to 6.12.0-55.50.1.el10_0
kernel-devel (Red Hat package) - update to 6.12.0-55.50.1.el10_0
kernel-devel-matched (Red Hat package) - update to 6.12.0-55.50.1.el10_0
kernel-headers (Red Hat package) - update to 6.12.0-55.50.1.el10_0
kernel-modules (Red Hat package) - update to 6.12.0-55.50.1.el10_0
kernel-modules-core (Red Hat package) - update to 6.12.0-55.50.1.el10_0
kernel-modules-extra (Red Hat package) - update to 6.12.0-55.50.1.el10_0
kernel-tools (Red Hat package) - update to 6.12.0-55.50.1.el10_0
kernel-tools-libs (Red Hat package) - update to 6.12.0-55.50.1.el10_0
kernel-uki-virt (Red Hat package) - update to 6.12.0-55.50.1.el10_0
kernel-uki-virt-addons (Red Hat package) - update to 6.12.0-55.50.1.el10_0
perf (Red Hat package) - update to 6.12.0-55.50.1.el10_0
python3-perf (Red Hat package) - update to 6.12.0-55.50.1.el10_0
rtla (Red Hat package) - update to 6.12.0-55.50.1.el10_0
rv (Red Hat package) - update to 6.12.0-55.50.1.el10_0
kernel-zfcpdump (Red Hat package) - update to 6.12.0-55.50.1.el10_0
kernel-zfcpdump-core (Red Hat package) - update to 6.12.0-55.50.1.el10_0
kernel-zfcpdump-devel (Red Hat package) - update to 6.12.0-55.50.1.el10_0
kernel-zfcpdump-devel-matched (Red Hat package) - update to 6.12.0-55.50.1.el10_0
kernel-zfcpdump-modules (Red Hat package) - update to 6.12.0-55.50.1.el10_0
kernel-zfcpdump-modules-core (Red Hat package) - update to 6.12.0-55.50.1.el10_0
kernel-zfcpdump-modules-extra (Red Hat package) - update to 6.12.0-55.50.1.el10_0
kernel-64k-debug-devel (Red Hat package) - update to 6.12.0-55.50.1.el10_0
kernel-64k-devel (Red Hat package) - update to 6.12.0-55.50.1.el10_0

• https://git.kernel.org/stable/c/17195a7d754a5c6a31888702ca93f6f08f3383ad
• https://git.kernel.org/stable/c/4e034bf045b12852a24d5d33f2451850818ba0c1
• https://git.kernel.org/stable/c/e4825368285e33d6360c6c6a6a10d2d83da06e55

• Use-after-free in Linux kernel iommu iommufd driver
• Red Hat Enterprise Linux 9 update for kernel
• Red Hat Enterprise Linux 10 update for kernel
• Red Hat Enterprise Linux 10 update for kernel