CVE-2025-39953

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

cgroup: split cgroup_destroy_wq into 3 workqueues

A hung task can occur during [1] LTP cgroup testing when repeatedly

mounting/unmounting perf_event and net_prio controllers with

systemd.unified_cgroup_hierarchy=1. The hang manifests in

cgroup_lock_and_drain_offline() during root destruction.

Related case:

cgroup_fj_function_perf_event cgroup_fj_function.sh perf_event

cgroup_fj_function_net_prio cgroup_fj_function.sh net_prio

Call Trace:

cgroup_lock_and_drain_offline+0x14c/0x1e8

cgroup_destroy_root+0x3c/0x2c0

css_free_rwork_fn+0x248/0x338

process_one_work+0x16c/0x3b8

worker_thread+0x22c/0x3b0

kthread+0xec/0x100

ret_from_fork+0x10/0x20

Root Cause:

CPU0 CPU1

mount perf_event umount net_prio

cgroup1_get_tree cgroup_kill_sb

rebind_subsystems // root destruction enqueues

// cgroup_destroy_wq

// kill all perf_event css

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References