{"id":"DEBIAN-CVE-2025-39900","details":"In the Linux kernel, the following vulnerability has been resolved:  net_sched: gen_estimator: fix est_timer() vs CONFIG_PREEMPT_RT=y  syzbot reported a WARNING in est_timer() [1]  Problem here is that with CONFIG_PREEMPT_RT=y, timer callbacks can be preempted.  Adopt preempt_disable_nested()/preempt_enable_nested() to fix this.  [1]  WARNING: CPU: 0 PID: 16 at ./include/linux/seqlock.h:221 __seqprop_assert include/linux/seqlock.h:221 [inline]  WARNING: CPU: 0 PID: 16 at ./include/linux/seqlock.h:221 est_timer+0x6dc/0x9f0 net/core/gen_estimator.c:93 Modules linked in: CPU: 0 UID: 0 PID: 16 Comm: ktimers/0 Not tainted syzkaller #0 PREEMPT_{RT,(full)} Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025  RIP: 0010:__seqprop_assert include/linux/seqlock.h:221 [inline]  RIP: 0010:est_timer+0x6dc/0x9f0 net/core/gen_estimator.c:93 Call Trace:  \u003cTASK\u003e   call_timer_fn+0x17e/0x5f0 kernel/time/timer.c:1747   expire_timers kernel/time/timer.c:1798 [inline]   __run_timers kernel/time/timer.c:2372 [inline]   __run_timer_base+0x648/0x970 kernel/time/timer.c:2384   run_timer_base kernel/time/timer.c:2393 [inline]   run_timer_softirq+0xb7/0x180 kernel/time/timer.c:2403   handle_softirqs+0x22c/0x710 kernel/softirq.c:579   __do_softirq kernel/softirq.c:613 [inline]   run_ktimerd+0xcf/0x190 kernel/softirq.c:1043   smpboot_thread_fn+0x53f/0xa60 kernel/smpboot.c:160   kthread+0x70e/0x8a0 kernel/kthread.c:463   ret_from_fork+0x3fc/0x770 arch/x86/kernel/process.c:148   ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245  \u003c/TASK\u003e","modified":"2026-08-27T23:05:30.895969894Z","published":"2025-10-01T08:15:32.740Z","upstream":["CVE-2025-39900"],"references":[{"type":"ADVISORY","url":"https://security-tracker.debian.org/tracker/CVE-2025-39900"}],"affected":[{"package":{"name":"linux","ecosystem":"Debian:13","purl":"pkg:deb/debian/linux?arch=source&distro=trixie"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.48-1"}]}],"versions":["6.12.38-1","6.12.41-1","6.12.43-1","6.12.43-1~bpo12+1"],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2025-39900.json"}},{"package":{"name":"linux","ecosystem":"Debian:14","purl":"pkg:deb/debian/linux?arch=source&distro=forky"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.16.6-1"}]}],"versions":["6.12.100-1","6.12.101-1","6.12.105-1","6.12.38-1","6.12.41-1","6.12.43-1","6.12.43-1~bpo12+1","6.12.48-1","6.12.57-1","6.12.57-1~bpo12+1","6.12.63-1","6.12.63-1~bpo12+1","6.12.69-1","6.12.69-1~bpo12+1","6.12.73-1","6.12.73-1~bpo12+1","6.12.74-1","6.12.74-2","6.12.74-2~bpo12+1","6.12.85-1","6.12.85-1~bpo12+1","6.12.86-1","6.12.86-1~bpo12+1","6.12.88-1","6.12.88-1~bpo12+1","6.12.90-1","6.12.90-1~bpo12+1","6.12.90-2","6.12.90-2~bpo12+1","6.12.94-1","6.12.94-1~bpo12+1","6.12.95-1","6.12.95-1~bpo12+1","6.12.96-1","6.13.10-1~exp1","6.13.11-1~exp1","6.13.2-1~exp1","6.13.3-1~exp1","6.13.4-1~exp1","6.13.5-1~exp1","6.13.6-1~exp1","6.13.7-1~exp1","6.13.8-1~exp1","6.13.9-1~exp1","6.13~rc6-1~exp1","6.13~rc7-1~exp1","6.14.3-1~exp1","6.14.5-1~exp1","6.14.6-1~exp1","6.15-1~exp1","6.15.1-1~exp1","6.15.2-1~exp1","6.15.3-1~exp1","6.15.4-1~exp1","6.15.5-1~exp1","6.15.6-1~exp1","6.15~rc7-1~exp1","6.16-1~exp1","6.16.1-1~exp1","6.16.3-1","6.16.3-1~bpo13+1","6.16.5-1","6.16~rc7-1~exp1"],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2025-39900.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"}]}