Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2025-39697— NFS: Fix a race when updating an existing write

Quick assessment

Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于NFS模块在更新现有写入时存在竞争条件。

CVSS 7.8 · High EPSS 0.15% · P4

Affected Version Matrix 16

VendorProduct Version RangeStatus
Linux Linux bd37d6fce184836bd5e7cd90ce40116a4fadaf2a< 0ff42a32784e0f2cb46a46da8e9f473538c13e1b affected
bd37d6fce184836bd5e7cd90ce40116a4fadaf2a< f230d40147cc37eb3aef4d50e2e2c06ea73d9a77 affected
bd37d6fce184836bd5e7cd90ce40116a4fadaf2a< c32e3c71aaa1c1ba05da88605e2ddd493c58794f affected
bd37d6fce184836bd5e7cd90ce40116a4fadaf2a< 181feb41f0b268e6288bf9a7b984624d7fe2031d affected
bd37d6fce184836bd5e7cd90ce40116a4fadaf2a< 92278ae36935a54e65fef9f8ea8efe7e80481ace affected
bd37d6fce184836bd5e7cd90ce40116a4fadaf2a< 202a3432d21ac060629a760fff3b0a39859da3ea affected
bd37d6fce184836bd5e7cd90ce40116a4fadaf2a< 76d2e3890fb169168c73f2e4f8375c7cc24a765e affected
4.14 affected
… +8 more rows
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2025-39697

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
NFS: Fix a race when updating an existing write
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: NFS: Fix a race when updating an existing write After nfs_lock_and_join_requests() tests for whether the request is still attached to the mapping, nothing prevents a call to nfs_inode_remove_request() from succeeding until we actually lock the page group. The reason is that whoever called nfs_inode_remove_request() doesn't necessarily have a lock on the page group head. So in order to avoid races, let's take the page group lock earlier in nfs_lock_and_join_requests(), and hold it across the removal of the request in nfs_inode_remove_request().
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Linux kernel 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于NFS模块在更新现有写入时存在竞争条件。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
Linux Linux bd37d6fce184836bd5e7cd90ce40116a4fadaf2a ~ 0ff42a32784e0f2cb46a46da8e9f473538c13e1b -
Linux Linux 4.14 -

II. Public POCs for CVE-2025-39697

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2025-39697

请登录查看更多情报信息。

Patches & Fixes for CVE-2025-39697 (1)

Same Patch Batch · Linux · 2025-09-05 · 60 CVEs total

CVE-2025-39726 9.8 CRITICAL s390/ism: fix concurrency management in ism_cmd()
CVE-2025-39682 9.8 CRITICAL tls: fix handling of zero-length records on the rx_list
CVE-2025-38734 9.8 CRITICAL net/smc: fix UAF on smcsk after smc_listen_out()
CVE-2025-39702 9.8 CRITICAL ipv6: sr: Fix MAC comparison to be constant-time
CVE-2025-39703 9.8 CRITICAL net, hsr: reject HSR frame if skb can't hold tag
CVE-2025-38737 9.8 CRITICAL cifs: Fix oops due to uninitialised variable
CVE-2025-39673 9.8 CRITICAL ppp: fix race conditions in ppp_fill_forward_path
CVE-2025-39704 8.8 HIGH LoongArch: KVM: Fix stack protector issue in send_ipi_data()
CVE-2025-39718 8.4 HIGH vsock/virtio: Validate length in packet header before skb_put()
CVE-2025-39711 7.8 HIGH media: ivsc: Fix crash at shutdown due to missing mei_cldev_disable() calls
CVE-2025-39710 7.8 HIGH media: venus: Add a check for packet size after reading from shared memory
CVE-2025-39696 7.8 HIGH ALSA: hda: tas2781: Fix wrong reference of tasdevice_priv
CVE-2025-39714 7.8 HIGH media: usbtv: Lock resolution while streaming
CVE-2025-39717 7.8 HIGH open_tree_attr: do not allow id-mapping changes without OPEN_TREE_CLONE
CVE-2025-39698 7.8 HIGH io_uring/futex: ensure io_futex_wait() cleans up properly on failure
CVE-2025-38731 7.8 HIGH drm/xe: Fix vm_bind_ioctl double free bug
CVE-2025-39691 7.8 HIGH fs/buffer: fix use-after-free when call bh_read() helper
CVE-2025-39689 7.8 HIGH ftrace: Also allocate and copy hash for reading of filter files
CVE-2025-39677 7.8 HIGH net/sched: Fix backlog accounting in qdisc_dequeue_internal
CVE-2025-39680 7.8 HIGH i2c: rtl9300: Fix out-of-bounds bug in rtl9300_i2c_smbus_xfer

Showing top 20 of 60 CVEs. View all on vendor page &rarr; →

IV. Related Vulnerabilities

Same product: Linux
Same vendor: Linux

V. Comments for CVE-2025-39697

No comments yet

Leave a comment