CVE-2025-39872: 
Linux Debian vulnerability analysis and mitigation

A vulnerability in the Linux kernel was identified and assigned CVE-2025-39872. The issue relates to the HSR (High-availability Seamless Redundancy) module, specifically in the hsrgetport_ndev function which requires proper RCU (Read-Copy-Update) lock handling. The vulnerability was disclosed on September 23, 2025 (NVD).

The vulnerability stems from improper lock handling in the HSR module of the Linux kernel. Specifically, the hsrgetportndev function calls hsrforeachport without holding the required RCU lock. Additionally, the port device reference needs to be held before returning to prevent Use-after-Free (UaF) conditions in the caller function (Debian Tracker).

The vulnerability could potentially lead to Use-after-Free (UaF) conditions in the Linux kernel's HSR module, which could affect system stability and security (NVD).

The vulnerability has been fixed in various Linux distributions. Debian has addressed this in multiple releases: version 6.16.8-1 for sid, while versions for bullseye, bookworm, and trixie have been marked as not affected due to the vulnerable code not being present (Debian Tracker).