Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2025-39723— netfs: Fix unbuffered write error handling

CVSS 7.1 · High EPSS 0.23% · P14

Affected Version Matrix 8

VendorProductVersion RangeStatus
LinuxLinux288ace2f57c9d06dd2e42bd80d03747d879a4068< f08c80af3c9a9849cd178b4843b7c01d103506a1affected
288ace2f57c9d06dd2e42bd80d03747d879a4068< 387164a2b97e1f5404c6d0049a7409bac7d2bc5baffected
288ace2f57c9d06dd2e42bd80d03747d879a4068< a3de58b12ce074ec05b8741fa28d62ccb1070468affected
6.10affected
< 6.10unaffected
6.12.44≤ 6.12.*unaffected
6.16.4≤ 6.16.*unaffected
6.17≤ *unaffected
Get alerts for future matching vulnerabilitiesLog in to subscribe

I. Basic Information for CVE-2025-39723

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
netfs: Fix unbuffered write error handling
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: netfs: Fix unbuffered write error handling If all the subrequests in an unbuffered write stream fail, the subrequest collector doesn't update the stream->transferred value and it retains its initial LONG_MAX value. Unfortunately, if all active streams fail, then we take the smallest value of { LONG_MAX, LONG_MAX, ... } as the value to set in wreq->transferred - which is then returned from ->write_iter(). LONG_MAX was chosen as the initial value so that all the streams can be quickly assessed by taking the smallest value of all stream->transferred - but this only works if we've set any of them. Fix this by adding a flag to indicate whether the value in stream->transferred is valid and checking that when we integrate the values. stream->transferred can then be initialised to zero. This was found by running the generic/750 xfstest against cifs with cache=none. It splices data to the target file. Once (if) it has used up all the available scratch space, the writes start failing with ENOSPC. This causes ->write_iter() to fail. However, it was returning wreq->transferred, i.e. LONG_MAX, rather than an error (because it thought the amount transferred was non-zero) and iter_file_splice_write() would then try to clean up that amount of pipe bufferage - leading to an oops when it overran. The kernel log showed: CIFS: VFS: Send error in write = -28 followed by: BUG: kernel NULL pointer dereference, address: 0000000000000008 with: RIP: 0010:iter_file_splice_write+0x3a4/0x520 do_splice+0x197/0x4e0 or: RIP: 0010:pipe_buf_release (include/linux/pipe_fs_i.h:282) iter_file_splice_write (fs/splice.c:755) Also put a warning check into splice to announce if ->write_iter() returned that it had written more than it was asked to.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Linux kernel 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于未正确更新传输值，可能导致数据损坏。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

VendorProductAffected VersionsCPESubscribe
LinuxLinux 288ace2f57c9d06dd2e42bd80d03747d879a4068 ~ f08c80af3c9a9849cd178b4843b7c01d103506a1 -
LinuxLinux 6.10 -

II. Public POCs for CVE-2025-39723

#POC DescriptionSource LinkShenlong Link
AI-Generated POCPremium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2025-39723

请登录查看更多情报信息。

Same Patch Batch · Linux · 2025-09-05 · 60 CVEs total

CVE-2025-397269.8 CRITICALs390/ism: fix concurrency management in ism_cmd()
CVE-2025-396829.8 CRITICALtls: fix handling of zero-length records on the rx_list
CVE-2025-387349.8 CRITICALnet/smc: fix UAF on smcsk after smc_listen_out()
CVE-2025-397029.8 CRITICALipv6: sr: Fix MAC comparison to be constant-time
CVE-2025-397039.8 CRITICALnet, hsr: reject HSR frame if skb can't hold tag
CVE-2025-387379.8 CRITICALcifs: Fix oops due to uninitialised variable
CVE-2025-396739.8 CRITICALppp: fix race conditions in ppp_fill_forward_path
CVE-2025-397048.8 HIGHLoongArch: KVM: Fix stack protector issue in send_ipi_data()
CVE-2025-397188.4 HIGHvsock/virtio: Validate length in packet header before skb_put()
CVE-2025-397117.8 HIGHmedia: ivsc: Fix crash at shutdown due to missing mei_cldev_disable() calls
CVE-2025-397107.8 HIGHmedia: venus: Add a check for packet size after reading from shared memory
CVE-2025-396967.8 HIGHALSA: hda: tas2781: Fix wrong reference of tasdevice_priv
CVE-2025-397147.8 HIGHmedia: usbtv: Lock resolution while streaming
CVE-2025-397177.8 HIGHopen_tree_attr: do not allow id-mapping changes without OPEN_TREE_CLONE
CVE-2025-396987.8 HIGHio_uring/futex: ensure io_futex_wait() cleans up properly on failure
CVE-2025-396977.8 HIGHNFS: Fix a race when updating an existing write
CVE-2025-387317.8 HIGHdrm/xe: Fix vm_bind_ioctl double free bug
CVE-2025-396917.8 HIGHfs/buffer: fix use-after-free when call bh_read() helper
CVE-2025-396897.8 HIGHftrace: Also allocate and copy hash for reading of filter files
CVE-2025-396777.8 HIGHnet/sched: Fix backlog accounting in qdisc_dequeue_internal

Showing top 20 of 60 CVEs. View all on vendor page &rarr; →

IV. Related Vulnerabilities

Same product: Linux
Same vendor: Linux

V. Comments for CVE-2025-39723

No comments yet

Leave a comment