Critical Locking Issue in Linux Kernel: CVE-2025-39886
Summary
CVE-2025-39886: In the Linux kernel, the following vulnerability has been resolved: bpf: Tell memcg to use allow_spinning=false path in bpf_timer_init() Currently, calling bpf_map_kmalloc_node() from bpf_async_init() can cause various l... Affects linux versions 6.1.106-1 – 6.9.9-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The Linux kernel is the core component of many operating systems, managing hardware resources and providing essential services to software applications. It is known for its stability, performance, and security features. However, vulnerabilities can arise, such as CVE-2025-39886, which affects the kernel's handling of BPF (Berkeley Packet Filter) timers, leading to potential locking issues that can cause system instability.
Vulnerability Detail
CVE-2025-39886 is a vulnerability in the Linux kernel that arises from improper handling of BPF timers during asynchronous initialization. This can lead to various locking issues, including double-acquisition of locks, which may cause hard lockups in the system. The vulnerability is triggered when calling bpf_map_kmalloc_node() from __bpf_async_init(), resulting in a failure to manage memory control group (memcg) accounting correctly. This can severely impact system performance and reliability.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can avoid calling bpf_timer_init() during ops.runnable() in your BPF programs. This may help mitigate the locking issues until the patch is applied.
Conclusion
CVE-2025-39886 is a significant vulnerability in the Linux kernel that can lead to severe locking issues and system instability. It is crucial to apply the available patch or implement workarounds to protect your systems. Regular monitoring for vulnerabilities using tools like Vulert can help maintain system security.
See every vulnerability recorded for linux →
FAQ
CVE-2025-39886 is a vulnerability in the Linux kernel related to BPF timer initialization that can lead to locking issues and system instability.
You can use Vulert, which monitors open-source vulnerabilities in your software. By uploading your manifest file, you can check for vulnerabilities like CVE-2025-39886.
The risks include potential system hard lockups, performance degradation, and instability due to improper memory management in the kernel.
Yes, a patch is available for Debian 13 in version 6.12.48-1. It is recommended to update to this version to mitigate the vulnerability.
If you cannot apply the patch, consider implementing the suggested workaround by avoiding certain BPF function calls that trigger the vulnerability.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
