CVE-2025-39966: In the Linux kernel, the following vulnerability has been resolved: iommufd: Fix race during abort for file descriptors fput() doesn't actually call file

In the Linux kernel, the following vulnerability has been resolved: iommufd: Fix race during abort for file descriptors fput() doesn't actually call file_oper

In the Linux kernel, the following vulnerability has been resolved: iommufd: Fix race during abort for file descriptors fput() doesn't actually call file_operations release() synchronously, it puts the file on a work queue and it will be released eventually. This is normally fine, except for iommufd the file and the iommufd_object are tied to gether. The file has the object as it's private_data and holds a users refcount, while the object is expected to remain alive as long as the file is. When the allocation of a new object aborts before installing the file it will fput() the file and then go on to immediately kfree() the obj. This causes a UAF once the workqueue completes the fput() and tries to decrement the users refcount. Fix this by putting the core code in charge of the file lifetime, and call __fput_sync() during abort to ensure that release() is called before kfree. __fput_sync() is a bit too tricky to open code in all the object implementations. Instead the objects tell the core code where the file pointer is and the core will take care of the life cycle. If the object is successfully allocated then the file will hold a users refcount and the iommufd_object cannot b

Description from the National Vulnerability Database, published by 416baaa9-dc9f-4396-8d5f-8c081fb06d67

What it means for a small business

Linux is on the computers, phones or browsers your team uses every day. Turn on automatic updates and restart: most of these fixes only take effect after a restart.

How likely is an attack? The Exploit Prediction Scoring System, run by FIRST (the global association of security response teams), puts the odds of this one being exploited in the next 30 days at 0.11%, higher than 1% of CVEs. That’s low, but low isn’t zero, and the odds jump the day someone publishes an exploit. Scored November 2, 2026, updated daily.

Check your own setup

Website check: reads what your site runs from the outside (WordPress version, plugins it can see, old server software) and matches it against this database.
Server check: what your web server says about itself, and whether that version has known flaws.

Sources

Part of the Huttenlocher Technologies vulnerability database, refreshed twice a day from CISA and the NVD. The title, category and plain-language guidance are ours; check the linked record before acting on a detail. This is general guidance, not a review of your systems.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.