5.5

CVE-2025-39953: linux

CVSS: 5.5v3.1MediumModified
AliasesUBUNTU-CVE-2025-39953DEBIAN-CVE-2025-39953
Published 04-10-2025Last modified 15-10-2026
Open JSON

Vulnerability summary

CVE-2025-39953 is a medium (CVSS 5.5) vulnerability in linux. EPSS estimates a 0.15% chance of exploitation in the next 30 days, higher than 4.1% of scored vulnerabilities.

Overall risk
22/100
0100
Low · default modelHow is this calculated?
CVSS score
5.5/10
010
Medium · v3.1 (NVD)
EPSS score
0.15%
0%100%
Low · 0.00 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 29 · Related 24
DLA-4379-1DLA-4404-1DSA-6053-1MGASA-2025-0309MGASA-2025-0310USN-8033-1

Timeline

  1. 04-10-2025
    PublishedVulnerability first disclosed.
  2. 15-10-2026
    Last modifiedVulnerability information updated.

Description

In the Linux kernel, the following vulnerability has been resolved: cgroup: split cgroup_destroy_wq into 3 workqueues A hung task can occur during [1] LTP cgroup testing when repeatedly mounting/unmounting perf_event and net_prio controllers with systemd.unified_cgroup_hierarchy=1. The hang manifests in cgroup_lock_and_drain_offline() during root destruction. Related case: cgroup_fj_function_perf_event cgroup_fj_function.sh perf_event cgroup_fj_function_net_prio cgroup_fj_function.sh net_prio Call Trace: cgroup_lock_and_drain_offline+0x14c/0x1e8 cgroup_destroy_root+0x3c/0x2c0 css_free_rwork_fn+0x248/0x338 process_one_work+0x16c/0x3b8 worker_thread+0x22c/0x3b0 kthread+0xec/0x100 ret_from_fork+0x10/0x20 Root Cause: CPU0 CPU1 mount perf_event umount net_prio cgroup1_get_tree cgroup_kill_sb rebind_subsystems // root destruction enqueues // cgroup_destroy_wq // kill all perf_event css // one perf_event css A is dying // css A offline enqueues cgroup_destroy_wq // root destruction will be executed first css_free_rwork_fn cgroup_destroy_root cgroup_lock_and_drain_offline // some perf descendants are dying // cgroup_destroy_wq max_active = 1 // waiting for css A to die Problem scenario: 1. CPU0 mounts perf_event (rebind_subsystems) 2. CPU1 unmounts net_prio (cgroup_kill_sb), queuing root destruction work 3. A dying perf_event CSS gets queued for offline after root destruction 4. Root destruction waits for offline completion, but offline work is blocked behind root destruction in cgroup_destroy_wq (max_active=1) Solution: Split cgroup_destroy_wq into three dedicated workqueues: cgroup_offline_wq – Handles CSS offline operations cgroup_release_wq – Manages resource release cgroup_free_wq – Performs final memory deallocation This separation eliminates blocking in the CSS free path while waiting for offline operations to complete. [1] https://github.com/linux-test-project/ltp/blob/master/runtest/controllers

CVSS metrics

3 scores · 3 sources · 1 version

EPSS trend

Probability

0.15%

Chance of exploitation in the next 30 days

Percentile

4%

Versus all other CVEs

30-day change

0.00 pp

From 0.15% on 19-09-2026

19-09-202619-10-2026
EPSS score
0.15%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

No weakness data has been published for this record.

Affected systems

Ubuntu147 products
  • linuxAll versions (No fix recorded) | < 5.15.0-170.180 | < 6.8.0-106.106
  • linux-allwinner-5.19All versions (No fix recorded)
  • linux-awsAll versions (No fix recorded) | < 5.15.0-1100.107 | < 6.8.0-1050.53
  • linux-aws-5.0All versions (No fix recorded)
  • linux-aws-5.11All versions (No fix recorded)
Linux2 products
  • linux≥ 334c3679ec4b2b113c35ebe37d2018b112dd5013, < cabadd7fd15f97090f752fd22dd7f876a0dc3dc4 | ≥ 334c3679ec4b2b113c35ebe37d2018b112dd5013, < a0c896bda7077aa5005473e2c5b3c27173313b4c | ≥ 334c3679ec4b2b113c35ebe37d2018b112dd5013, < f2795d1b92506e3adf52a298f7181032a1525e04 | ≥ 334c3679ec4b2b113c35ebe37d2018b112dd5013, < 993049c9b1355c78918344a6403427d53f9ee700 | ≥ 334c3679ec4b2b113c35ebe37d2018b112dd5013, < 4a1e3ec28e8062cd9f339aa6a942df9c5bcb6811 | ≥ 334c3679ec4b2b113c35ebe37d2018b112dd5013, < ded4d207a3209a834b6831ceec7f39b934c74802 | ≥ 334c3679ec4b2b113c35ebe37d2018b112dd5013, < 05e0b03447cf215ec384210441b34b7a3b16e8b0 | ≥ 334c3679ec4b2b113c35ebe37d2018b112dd5013, < 79f919a89c9d06816dbdbbd168fa41d27411a7f9 | 4.6
  • linux_kernel≥ 4.6, < 5.4.300 | ≥ 5.5, < 5.10.245 | ≥ 5.11, < 5.15.194 | ≥ 5.16, < 6.1.154 | ≥ 6.2, < 6.6.108 | ≥ 6.7, < 6.12.49 | ≥ 6.13, < 6.16.9 | 6.17:rc1 | 6.17:rc2 | 6.17:rc3 | 6.17:rc4 | 6.17:rc5 | 6.17:rc6
Debian1 product
  • linux< 6.1.158-1 | < 6.12.57-1 | < 6.16.9-1

3 vendors · 150 products

References

39 links
Show all 39 references