Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2025-37806— fs/ntfs3: Keep write operations atomic

Quick assessment

Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于未使用inode锁同步ioctl和写入操作导致空指针取消引用。

AI Predicted 7.8 Difficulty: Hard EPSS 0.20% · P10

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application

Affected Version Matrix 10

VendorProduct Version RangeStatus
Linux Linux 4534a70b7056fd4b9a1c6db5a4ce3c98546b291e< 7af81befc042853949982439f847e25fedef6598 affected
4534a70b7056fd4b9a1c6db5a4ce3c98546b291e< 8db49e89a7f8b48ee59fa9ad32b6ed0879747df8 affected
4534a70b7056fd4b9a1c6db5a4ce3c98546b291e< 464139e18f619aa14fb921a61721862f43421c54 affected
4534a70b7056fd4b9a1c6db5a4ce3c98546b291e< 285cec318bf5a7a6c8ba999b2b6ec96f9a20590f affected
5.15 affected
< 5.15 unaffected
6.6.160≤ 6.6.* unaffected
6.12.26≤ 6.12.* unaffected
… +2 more rows
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2025-37806

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
fs/ntfs3: Keep write operations atomic
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: Keep write operations atomic syzbot reported a NULL pointer dereference in __generic_file_write_iter. [1] Before the write operation is completed, the user executes ioctl[2] to clear the compress flag of the file, which causes the is_compressed() judgment to return 0, further causing the program to enter the wrong process and call the wrong ops ntfs_aops_cmpr, which triggers the null pointer dereference of write_begin. Use inode lock to synchronize ioctl and write to avoid this case. [1] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000 Mem abort info: ESR = 0x0000000086000006 EC = 0x21: IABT (current EL), IL = 32 bits SET = 0, FnV = 0 EA = 0, S1PTW = 0 FSC = 0x06: level 2 translation fault user pgtable: 4k pages, 48-bit VAs, pgdp=000000011896d000 [0000000000000000] pgd=0800000118b44403, p4d=0800000118b44403, pud=0800000117517403, pmd=0000000000000000 Internal error: Oops: 0000000086000006 [#1] PREEMPT SMP Modules linked in: CPU: 0 UID: 0 PID: 6427 Comm: syz-executor347 Not tainted 6.13.0-rc3-syzkaller-g573067a5a685 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024 pstate: 80400005 (Nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : 0x0 lr : generic_perform_write+0x29c/0x868 mm/filemap.c:4055 sp : ffff80009d4978a0 x29: ffff80009d4979c0 x28: dfff800000000000 x27: ffff80009d497bc8 x26: 0000000000000000 x25: ffff80009d497960 x24: ffff80008ba71c68 x23: 0000000000000000 x22: ffff0000c655dac0 x21: 0000000000001000 x20: 000000000000000c x19: 1ffff00013a92f2c x18: ffff0000e183aa1c x17: 0004060000000014 x16: ffff800083275834 x15: 0000000000000001 x14: 0000000000000000 x13: 0000000000000001 x12: ffff0000c655dac0 x11: 0000000000ff0100 x10: 0000000000ff0100 x9 : 0000000000000000 x8 : 0000000000000000 x7 : 0000000000000000 x6 : 0000000000000000 x5 : ffff80009d497980 x4 : ffff80009d497960 x3 : 0000000000001000 x2 : 0000000000000000 x1 : ffff0000e183a928 x0 : ffff0000d60b0fc0 Call trace: 0x0 (P) __generic_file_write_iter+0xfc/0x204 mm/filemap.c:4156 ntfs_file_write_iter+0x54c/0x630 fs/ntfs3/file.c:1267 new_sync_write fs/read_write.c:586 [inline] vfs_write+0x920/0xcf4 fs/read_write.c:679 ksys_write+0x15c/0x26c fs/read_write.c:731 __do_sys_write fs/read_write.c:742 [inline] __se_sys_write fs/read_write.c:739 [inline] __arm64_sys_write+0x7c/0x90 fs/read_write.c:739 __invoke_syscall arch/arm64/kernel/syscall.c:35 [inline] invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:49 el0_svc_common+0x130/0x23c arch/arm64/kernel/syscall.c:132 do_el0_svc+0x48/0x58 arch/arm64/kernel/syscall.c:151 el0_svc+0x54/0x168 arch/arm64/kernel/entry-common.c:744 el0t_64_sync_handler+0x84/0x108 arch/arm64/kernel/entry-common.c:762 [2] ioctl$FS_IOC_SETFLAGS(r0, 0x40086602, &(0x7f00000000c0)=0x20)
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Linux kernel 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于未使用inode锁同步ioctl和写入操作导致空指针取消引用。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
Linux Linux 4534a70b7056fd4b9a1c6db5a4ce3c98546b291e ~ 7af81befc042853949982439f847e25fedef6598 -
Linux Linux 5.15 -

II. Public POCs for CVE-2025-37806

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2025-37806

请登录查看更多情报信息。

Patches & Fixes for CVE-2025-37806 (1)

Same Patch Batch · Linux · 2025-05-08 · 33 CVEs total

CVE-2025-37801 7.8 HIGH spi: spi-imx: Add check for spi_imx_setupxfer()
CVE-2025-37822 7.8 HIGH riscv: uprobes: Add missing fence.i after building the XOL buffer
CVE-2025-37823 7.8 HIGH net_sched: hfsc: Fix a potential UAF in hfsc_dequeue() too
CVE-2025-37814 7.8 HIGH tty: Require CAP_SYS_ADMIN for all usages of TIOCL_SELMOUSEREPORT
CVE-2025-37813 7.8 HIGH usb: xhci: Fix invalid pointer dereference in Etron workaround
CVE-2025-37820 7.5 HIGH xen-netfront: handle NULL returned by xdp_convert_buff_to_frame()
CVE-2025-37802 7.5 HIGH ksmbd: fix WARNING "do not call blocking ops when !TASK_RUNNING"
CVE-2025-37800 7.1 HIGH driver core: fix potential NULL pointer dereference in dev_uevent()
CVE-2025-37830 cpufreq: scmi: Fix null-ptr-deref in scmi_cpufreq_get_rate()
CVE-2025-37829 cpufreq: scpi: Fix null-ptr-deref in scpi_cpufreq_get_rate()
CVE-2025-37828 scsi: ufs: mcq: Add NULL check in ufshcd_mcq_abort()
CVE-2025-37826 scsi: ufs: core: Add NULL check in ufshcd_mcq_compl_pending_transfer()
CVE-2025-37827 btrfs: zoned: return EIO on RAID1 block group write pointer mismatch
CVE-2025-37831 cpufreq: apple-soc: Fix null-ptr-deref in apple_soc_cpufreq_get_rate()
CVE-2025-37834 mm/vmscan: don't try to reclaim hwpoison folio
CVE-2025-37825 nvmet: fix out-of-bounds access in nvmet_enable_port
CVE-2025-37824 tipc: fix NULL pointer dereference in tipc_mon_reinit_self()
CVE-2025-37821 sched/eevdf: Fix se->slice being set to U64_MAX and resulting crash
CVE-2025-37833 net/niu: Niu requires MSIX ENTRY_DATA fields touch before entry reads
CVE-2025-37819 irqchip/gic-v2m: Prevent use after free of gicv2m_get_fwnode()

Showing top 20 of 33 CVEs. View all on vendor page &rarr; →

IV. Related Vulnerabilities

Same product: Linux
Same vendor: Linux

V. Comments for CVE-2025-37806

No comments yet

Leave a comment