Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2025-37999— fs/erofs/fileio: call erofs_onlinefolio_split() after bio_add_folio()

Quick assessment

Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于erofs_fileio_scan_folio中的bio_add_folio和erofs_onlinefolio_split调用顺序不当。

AI Predicted 7.8 Difficulty: Moderate EPSS 0.18% · P7

Affected Version Matrix 8

VendorProduct Version RangeStatus
Linux Linux ce63cb62d794c98c7631c2296fa845f2a8d0a4a1< 61e0fc3312309867e5a3495329dad0286d2a5703 affected
ce63cb62d794c98c7631c2296fa845f2a8d0a4a1< c26076197df348c84cc23e5962d61902e072a0f5 affected
ce63cb62d794c98c7631c2296fa845f2a8d0a4a1< bbfe756dc3062c1e934f06e5ba39c239aa953b92 affected
6.12 affected
< 6.12 unaffected
6.12.29≤ 6.12.* unaffected
6.14.7≤ 6.14.* unaffected
6.15≤ * unaffected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2025-37999

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
fs/erofs/fileio: call erofs_onlinefolio_split() after bio_add_folio()
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: fs/erofs/fileio: call erofs_onlinefolio_split() after bio_add_folio() If bio_add_folio() fails (because it is full), erofs_fileio_scan_folio() needs to submit the I/O request via erofs_fileio_rq_submit() and allocate a new I/O request with an empty `struct bio`. Then it retries the bio_add_folio() call. However, at this point, erofs_onlinefolio_split() has already been called which increments `folio->private`; the retry will call erofs_onlinefolio_split() again, but there will never be a matching erofs_onlinefolio_end() call. This leaves the folio locked forever and all waiters will be stuck in folio_wait_bit_common(). This bug has been added by commit ce63cb62d794 ("erofs: support unencoded inodes for fileio"), but was practically unreachable because there was room for 256 folios in the `struct bio` - until commit 9f74ae8c9ac9 ("erofs: shorten bvecs[] for file-backed mounts") which reduced the array capacity to 16 folios. It was now trivial to trigger the bug by manually invoking readahead from userspace, e.g.: posix_fadvise(fd, 0, st.st_size, POSIX_FADV_WILLNEED); This should be fixed by invoking erofs_onlinefolio_split() only after bio_add_folio() has succeeded. This is safe: asynchronous completions invoking erofs_onlinefolio_end() will not unlock the folio because erofs_fileio_scan_folio() is still holding a reference to be released by erofs_onlinefolio_end() at the end.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Linux kernel 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于erofs_fileio_scan_folio中的bio_add_folio和erofs_onlinefolio_split调用顺序不当。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
Linux Linux ce63cb62d794c98c7631c2296fa845f2a8d0a4a1 ~ 61e0fc3312309867e5a3495329dad0286d2a5703 -
Linux Linux 6.12 -

II. Public POCs for CVE-2025-37999

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2025-37999

请登录查看更多情报信息。

Patches & Fixes for CVE-2025-37999 (1)

Same Patch Batch · Linux · 2025-05-29 · 7 CVEs total

CVE-2025-37996 8.8 HIGH KVM: arm64: Fix uninitialized memcache pointer in user_mem_abort()
CVE-2025-37998 7.8 HIGH openvswitch: Fix unsafe attribute parsing in output_userspace()
CVE-2025-37997 7.8 HIGH netfilter: ipset: fix region locking in hash types
CVE-2025-37995 module: ensure that kobject_put() is safe for module type kobjects
CVE-2025-37994 usb: typec: ucsi: displayport: Fix NULL pointer access
CVE-2025-37993 can: m_can: m_can_class_allocate_dev(): initialize spin lock on device probe

IV. Related Vulnerabilities

Same product: Linux
Same vendor: Linux

V. Comments for CVE-2025-37999

No comments yet

Leave a comment