CVE-2025-39900

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> net_sched: gen_estimator: fix est_timer() vs CONFIG_PREEMPT_RT=y<br /> <br /> syzbot reported a WARNING in est_timer() [1]<br /> <br /> Problem here is that with CONFIG_PREEMPT_RT=y, timer callbacks<br /> can be preempted.<br /> <br /> Adopt preempt_disable_nested()/preempt_enable_nested() to fix this.<br /> <br /> [1]<br /> WARNING: CPU: 0 PID: 16 at ./include/linux/seqlock.h:221 __seqprop_assert include/linux/seqlock.h:221 [inline]<br /> WARNING: CPU: 0 PID: 16 at ./include/linux/seqlock.h:221 est_timer+0x6dc/0x9f0 net/core/gen_estimator.c:93<br /> Modules linked in:<br /> CPU: 0 UID: 0 PID: 16 Comm: ktimers/0 Not tainted syzkaller #0 PREEMPT_{RT,(full)}<br /> Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025<br /> RIP: 0010:__seqprop_assert include/linux/seqlock.h:221 [inline]<br /> RIP: 0010:est_timer+0x6dc/0x9f0 net/core/gen_estimator.c:93<br /> Call Trace:<br /> <br /> call_timer_fn+0x17e/0x5f0 kernel/time/timer.c:1747<br /> expire_timers kernel/time/timer.c:1798 [inline]<br /> __run_timers kernel/time/timer.c:2372 [inline]<br /> __run_timer_base+0x648/0x970 kernel/time/timer.c:2384<br /> run_timer_base kernel/time/timer.c:2393 [inline]<br /> run_timer_softirq+0xb7/0x180 kernel/time/timer.c:2403<br /> handle_softirqs+0x22c/0x710 kernel/softirq.c:579<br /> __do_softirq kernel/softirq.c:613 [inline]<br /> run_ktimerd+0xcf/0x190 kernel/softirq.c:1043<br /> smpboot_thread_fn+0x53f/0xa60 kernel/smpboot.c:160<br /> kthread+0x70e/0x8a0 kernel/kthread.c:463<br /> ret_from_fork+0x3fc/0x770 arch/x86/kernel/process.c:148<br /> ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245<br />