CVE-2025-39886: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-39886 is a vulnerability discovered in the Linux kernel related to locking issues in the BPF subsystem. The vulnerability was published on September 23, 2025, and specifically affects the bpftimerinit() functionality when calling bpfmapkmallocnode() from _bpfasyncinit() (NVD Database).

The vulnerability manifests as various locking issues when calling bpfmapkmallocnode() from _bpfasyncinit(). The issue can lead to double-acquiring locks such as rqlock, cgroupfileknlock, and workerpool::lock, potentially causing system hardlocks. The problem occurs specifically during memory accounting events when MEMCGMAX events are raised during bpftimerinit() operations (NVD Database).

The vulnerability can result in system hardlocks due to double-acquiring of locks, which could potentially affect system stability and performance. This primarily impacts Linux kernel operations involving BPF timer initialization and memory management (Debian Tracker).

The issue has been fixed by using GFPHIGH instead of GFPATOMIC in bpfasyncinit(), which prevents the problematic behavior when trychargememcg() raises MEMCGMAX events. The fix ensures that _memcgmemoryevent() is called with allowspinning=false, avoiding the call to cgroupfile_notify() (NVD Database).