Log in Start free

Vulnerability · Published Sep 23, 2025 · Assigned by Linux

CVE-2025-39872hsr: hold rcu and dev lock for hsr_get_port_ndev

High 7.8

In plain English

A high-severity security flaw in Linux from Linux. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 5% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.8High
Exploit odds (30 days)0.2%top 95.3% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known

Official description

In the Linux kernel, the following vulnerability has been resolved: hsr: hold rcu and dev lock for hsr_get_port_ndev hsr_get_port_ndev calls hsr_for_each_port, which need to hold rcu lock. On the other hand, before return the port device, we need to hold the device reference to avoid UaF in the caller function.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:13linux6.12.69-1DEBIAN-CVE-2025-39872
Debian:13linux6.12.69-1DSA-6126-1
Debian:14linux6.16.8-1DEBIAN-CVE-2025-39872
Ubuntu:22.04:LTSlinux-allwinner-5.19no fix listedUBUNTU-CVE-2025-39872
Ubuntu:22.04:LTSlinux-aws-5.19no fix listedUBUNTU-CVE-2025-39872
Ubuntu:24.04:LTSlinux-aws-6.14no fix listedUBUNTU-CVE-2025-39872
Ubuntu:22.04:LTSlinux-aws-6.2no fix listedUBUNTU-CVE-2025-39872
Ubuntu:22.04:LTSlinux-aws-6.5no fix listedUBUNTU-CVE-2025-39872
Ubuntu:22.04:LTSlinux-azure-5.19no fix listedUBUNTU-CVE-2025-39872
Ubuntu:24.04:LTSlinux-azure-6.11no fix listedUBUNTU-CVE-2025-39872
Ubuntu:24.04:LTSlinux-azure-6.14no fix listedUBUNTU-CVE-2025-39872
Ubuntu:22.04:LTSlinux-azure-6.2no fix listedUBUNTU-CVE-2025-39872
Ubuntu:22.04:LTSlinux-azure-6.5no fix listedUBUNTU-CVE-2025-39872
Ubuntu:25.10linux-azure-fdeno fix listedUBUNTU-CVE-2025-39872
Ubuntu:22.04:LTSlinux-azure-fde-5.19no fix listedUBUNTU-CVE-2025-39872
Ubuntu:24.04:LTSlinux-azure-fde-6.14no fix listedUBUNTU-CVE-2025-39872
Ubuntu:22.04:LTSlinux-azure-fde-6.2no fix listedUBUNTU-CVE-2025-39872
Ubuntu:24.04:LTSlinux-azure-nvidia-6.14no fix listedUBUNTU-CVE-2025-39872
Ubuntu:22.04:LTSlinux-gcp-5.19no fix listedUBUNTU-CVE-2025-39872
Ubuntu:24.04:LTSlinux-gcp-6.11no fix listedUBUNTU-CVE-2025-39872
Ubuntu:24.04:LTSlinux-gcp-6.14no fix listedUBUNTU-CVE-2025-39872
Ubuntu:22.04:LTSlinux-gcp-6.2no fix listedUBUNTU-CVE-2025-39872
Ubuntu:22.04:LTSlinux-gcp-6.5no fix listedUBUNTU-CVE-2025-39872
Ubuntu:22.04:LTSlinux-hwe-5.19no fix listedUBUNTU-CVE-2025-39872
Ubuntu:24.04:LTSlinux-hwe-6.11no fix listedUBUNTU-CVE-2025-39872
Ubuntu:24.04:LTSlinux-hwe-6.14no fix listedUBUNTU-CVE-2025-39872
Ubuntu:22.04:LTSlinux-hwe-6.2no fix listedUBUNTU-CVE-2025-39872
Ubuntu:22.04:LTSlinux-hwe-6.5no fix listedUBUNTU-CVE-2025-39872
Ubuntu:24.04:LTSlinux-intelno fix listedUBUNTU-CVE-2025-39872
Ubuntu:22.04:LTSlinux-intel-iot-realtimeno fix listedUBUNTU-CVE-2025-39872
Ubuntu:22.04:LTSlinux-lowlatency-hwe-5.19no fix listedUBUNTU-CVE-2025-39872
Ubuntu:24.04:LTSlinux-lowlatency-hwe-6.11no fix listedUBUNTU-CVE-2025-39872
Ubuntu:22.04:LTSlinux-lowlatency-hwe-6.2no fix listedUBUNTU-CVE-2025-39872
Ubuntu:22.04:LTSlinux-lowlatency-hwe-6.5no fix listedUBUNTU-CVE-2025-39872
Ubuntu:22.04:LTSlinux-nvidia-6.2no fix listedUBUNTU-CVE-2025-39872
Ubuntu:22.04:LTSlinux-nvidia-6.5no fix listedUBUNTU-CVE-2025-39872
Ubuntu:22.04:LTSlinux-oem-5.17no fix listedUBUNTU-CVE-2025-39872
Ubuntu:22.04:LTSlinux-oem-6.0no fix listedUBUNTU-CVE-2025-39872
Ubuntu:22.04:LTSlinux-oem-6.1no fix listedUBUNTU-CVE-2025-39872
Ubuntu:24.04:LTSlinux-oem-6.11no fix listedUBUNTU-CVE-2025-39872
Ubuntu:24.04:LTSlinux-oem-6.14no fix listedUBUNTU-CVE-2025-39872
Ubuntu:22.04:LTSlinux-oem-6.5no fix listedUBUNTU-CVE-2025-39872
Ubuntu:24.04:LTSlinux-oem-6.8no fix listedUBUNTU-CVE-2025-39872
Ubuntu:24.04:LTSlinux-oracle-6.14no fix listedUBUNTU-CVE-2025-39872
Ubuntu:22.04:LTSlinux-oracle-6.5no fix listedUBUNTU-CVE-2025-39872
Ubuntu:24.04:LTSlinux-raspi-realtimeno fix listedUBUNTU-CVE-2025-39872
Ubuntu:22.04:LTSlinux-realtimeno fix listedUBUNTU-CVE-2025-39872
Ubuntu:24.04:LTSlinux-realtimeno fix listedUBUNTU-CVE-2025-39872
Ubuntu:22.04:LTSlinux-riscvno fix listedUBUNTU-CVE-2025-39872
Ubuntu:24.04:LTSlinux-riscvno fix listedUBUNTU-CVE-2025-39872
Ubuntu:22.04:LTSlinux-riscv-5.19no fix listedUBUNTU-CVE-2025-39872
Ubuntu:24.04:LTSlinux-riscv-6.14no fix listedUBUNTU-CVE-2025-39872
Ubuntu:22.04:LTSlinux-riscv-6.5no fix listedUBUNTU-CVE-2025-39872
Ubuntu:22.04:LTSlinux-starfive-5.19no fix listedUBUNTU-CVE-2025-39872
Ubuntu:22.04:LTSlinux-starfive-6.2no fix listedUBUNTU-CVE-2025-39872
Ubuntu:22.04:LTSlinux-starfive-6.5no fix listedUBUNTU-CVE-2025-39872

Affected products (as reported)

VendorProductVersions
Linux Linux ef964411c8ca775967355d855abc56aeaca3c867 – before 9433ba79c2ec3ec7c9a711748701549339c3438c9c10dd8eed74de9e8adeb820939f8745cd566d4a – before 68a6729afd3e8e9a2a32538642ce92b96ccf9b1d9c10dd8eed74de9e8adeb820939f8745cd566d4a – before 847748fc66d08a89135a74e29362a66ba4e3ab156.12.63 – before 6.12.64
Linux Linux 6.14

References