CVE-2025-39866: 
Linux Kernel vulnerability analysis and mitigation

A use-after-free vulnerability (CVE-2025-39866) was discovered in the Linux kernel's filesystem writeback mechanism, specifically in the markinodedirty() function. The vulnerability was disclosed on September 19, 2025, affecting various Linux kernel versions including 5.10.x through 6.16.x. The issue occurs when markinodedirty() accesses the bdi_writeback that is in the process of switching (NVD, Debian Tracker).

The vulnerability manifests as a race condition in the kernel's filesystem writeback mechanism. The issue occurs during the inode dirty marking process when the bdiwriteback is being switched. The problem specifically involves the interaction between _markinodedirty(), inodeswitchwbsworkfn, and wbwakeupdelayed() functions. Red Hat has assigned this vulnerability a CVSS v3.1 base score of 7.0 (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) (Red Hat).

The vulnerability affects multiple Linux distributions and versions, including Red Hat Enterprise Linux 6 through 10, Debian Bullseye, Bookworm, and Trixie. The use-after-free condition could potentially lead to system crashes, data corruption, or privilege escalation (Debian Tracker, Red Hat).

The vulnerability has been fixed in Linux kernel version 6.16.7-1 and later. The fix involves holding the inode spinlock until wbwakeupdelayed() has finished execution. Debian has marked this as fixed in their 'forky' and 'sid' distributions with version 6.16.7-1 (Debian Tracker).