CVE-2025-39977 is a use-after-free vulnerability in the Linux kernel's futex implementation during requeue-PI operations. The race condition occurs between two threads where futex_wait_requeue_pi() may leave without using futex_q::lock_ptr for synchronization, causing futex_q to become garbage on the stack. The vulnerability is mitigated by reading futex_q::task before updating futex_q::requeue_state, leveraging the fact that requeue_pi_wake_futex() is called with a spinlock held, which implies a safe RCU read section. This prevents use-after-free by ensuring the task_struct remains valid during wake_up_state() calls.

Successful exploitation of this vulnerability could lead to use-after-free conditions in the kernel, potentially allowing an attacker with local privileges to cause memory corruption. The CVSS vector indicates high impact on confidentiality, integrity, and availability, meaning it could lead to privilege escalation, arbitrary code execution, or system crashes.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official patch or fix links are provided in the available data. Users should monitor Linux kernel updates and apply official patches once available to address this vulnerability.