CVE-2025-39866

A flaw was found in the Linux kernel. A race condition in the writeback subsystem can lead to a use-after-free vulnerability when an inode's writeback structure is concurrently switched. A local attacker with administrative privileges could trigger this flaw during writeback management operations to crash the kernel, resulting in a denial of service (DoS) or potentially allowing arbitrary code execution in the kernel context.

A race condition in __mark_inode_dirty() could lead to a use-after-free when the inode’s writeback structure (bdi_writeback) is being switched concurrently by another thread. The bug may result in a kernel crash (DoS) under heavy I/O or writeback migration workloads. The vulnerability can only be triggered through actions involving inode writeback switching and cgroup writeback management, which require elevated privileges (CAP_SYS_ADMIN). The CIA impact vector (H/H/H) represents a conservative worst-case scenario, assuming the use-after-free could be exploited to execute arbitrary code in kernel context. In practice, due to the limited control over memory and the need for privileged access, a more realistic assessment is CIA: N/N/H, reflecting potential system instability or denial of service rather than full compromise.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.