CVE-2025-39749

CVE-2025-39749 is a data race vulnerability in the Linux kernel's RCU (Read-Copy-Update) mechanism, specifically affecting the ->defer_qs_iw_pending field in the rcu_data structure. This flaw occurs when rcu_read_unlock_special() and rcu_preempt_deferred_qs_handler() attempt to access and modify this field concurrently, particularly in kernels configured with CONFIG_IRQ_WORK=y or rcutree.use_softirq=y. The vulnerability impacts various Linux distributions, including Debian and Ubuntu. The vulnerability has a CVSSv3.1 score of 7.0 (HIGH), indicating a local attack vector with high impact on confidentiality, integrity, and availability, but with high attack complexity and requiring low privileges. The data race can lead to system instability or crashes, as evidenced by KCSAN splats. Currently, there is no evidence of active exploitation, nor are there publicly available exploit modules in Metasploit, Nuclei, or ExploitDB. Despite this, the vulnerability has garnered significant community discussion and media coverage, suggesting a recognized importance within the cybersecurity community.