CVE-2025-39723

{"id": "CVE-2025-39723", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 4.2, "exploitabilityScore": 2.8}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.8}]}, "affected": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "affectedData": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "288ace2f57c9d06dd2e42bd80d03747d879a4068", "lessThan": "f08c80af3c9a9849cd178b4843b7c01d103506a1", "versionType": "git"}, {"status": "affected", "version": "288ace2f57c9d06dd2e42bd80d03747d879a4068", "lessThan": "387164a2b97e1f5404c6d0049a7409bac7d2bc5b", "versionType": "git"}, {"status": "affected", "version": "288ace2f57c9d06dd2e42bd80d03747d879a4068", "lessThan": "a3de58b12ce074ec05b8741fa28d62ccb1070468", "versionType": "git"}], "programFiles": ["fs/netfs/read_collect.c", "fs/netfs/write_collect.c", "fs/netfs/write_issue.c", "fs/splice.c", "include/linux/netfs.h"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "6.10"}, {"status": "unaffected", "version": "0", "lessThan": "6.10", "versionType": "semver"}, {"status": "unaffected", "version": "6.12.44", "versionType": "semver", "lessThanOrEqual": "6.12.*"}, {"status": "unaffected", "version": "6.16.4", "versionType": "semver", "lessThanOrEqual": "6.16.*"}, {"status": "unaffected", "version": "6.17", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["fs/netfs/read_collect.c", "fs/netfs/write_collect.c", "fs/netfs/write_issue.c", "fs/splice.c", "include/linux/netfs.h"], "defaultStatus": "affected"}]}], "published": "2025-09-05T18:15:50.043", "references": [{"url": "https://git.kernel.org/stable/c/387164a2b97e1f5404c6d0049a7409bac7d2bc5b", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/a3de58b12ce074ec05b8741fa28d62ccb1070468", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/f08c80af3c9a9849cd178b4843b7c01d103506a1", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-787"}]}], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfs: Fix unbuffered write error handling\n\nIf all the subrequests in an unbuffered write stream fail, the subrequest\ncollector doesn't update the stream->transferred value and it retains its\ninitial LONG_MAX value. Unfortunately, if all active streams fail, then we\ntake the smallest value of { LONG_MAX, LONG_MAX, ... } as the value to set\nin wreq->transferred - which is then returned from ->write_iter().\n\nLONG_MAX was chosen as the initial value so that all the streams can be\nquickly assessed by taking the smallest value of all stream->transferred -\nbut this only works if we've set any of them.\n\nFix this by adding a flag to indicate whether the value in\nstream->transferred is valid and checking that when we integrate the\nvalues. stream->transferred can then be initialised to zero.\n\nThis was found by running the generic/750 xfstest against cifs with\ncache=none. It splices data to the target file. Once (if) it has used up\nall the available scratch space, the writes start failing with ENOSPC.\nThis causes ->write_iter() to fail. However, it was returning\nwreq->transferred, i.e. LONG_MAX, rather than an error (because it thought\nthe amount transferred was non-zero) and iter_file_splice_write() would\nthen try to clean up that amount of pipe bufferage - leading to an oops\nwhen it overran. The kernel log showed:\n\n CIFS: VFS: Send error in write = -28\n\nfollowed by:\n\n BUG: kernel NULL pointer dereference, address: 0000000000000008\n\nwith:\n\n RIP: 0010:iter_file_splice_write+0x3a4/0x520\n do_splice+0x197/0x4e0\n\nor:\n\n RIP: 0010:pipe_buf_release (include/linux/pipe_fs_i.h:282)\n iter_file_splice_write (fs/splice.c:755)\n\nAlso put a warning check into splice to announce if ->write_iter() returned\nthat it had written more than it was asked to."}, {"lang": "es", "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad:\n\nnetfs: Correcci\u00f3n del manejo de errores de escritura sin b\u00fafer\n\nSi todas las subpeticiones en un flujo de escritura sin b\u00fafer fallan, el recolector de subpeticiones no actualiza el valor de stream->transferred y este retiene su valor inicial LONG_MAX. Desafortunadamente, si todos los flujos activos fallan, entonces tomamos el valor m\u00e1s peque\u00f1o de { LONG_MAX, LONG_MAX, ... } como el valor a establecer en wreq->transferred, el cual es luego devuelto desde ->write_iter().\n\nLONG_MAX fue elegido como el valor inicial para que todos los flujos puedan ser evaluados r\u00e1pidamente tomando el valor m\u00e1s peque\u00f1o de todos los stream->transferred, pero esto solo funciona si hemos establecido alguno de ellos.\n\nSolucione esto a\u00f1adiendo una bandera para indicar si el valor en stream->transferred es v\u00e1lido y verificando eso cuando integramos los valores. stream->transferred puede entonces ser inicializado a cero.\n\nEsto fue encontrado ejecutando el xfstest generic/750 contra cifs con cache=none. Empalma datos al archivo de destino. Una vez (si) ha agotado todo el espacio de trabajo disponible, las escrituras comienzan a fallar con ENOSPC. Esto causa que ->write_iter() falle. Sin embargo, estaba devolviendo wreq->transferred, es decir, LONG_MAX, en lugar de un error (porque pens\u00f3 que la cantidad transferida no era cero) e iter_file_splice_write() intentar\u00eda entonces limpiar esa cantidad de b\u00fafer de tuber\u00eda, lo que llev\u00f3 a un 'oops' cuando se desbord\u00f3. El registro del kernel mostr\u00f3:\n\n CIFS: VFS: Send error in write = -28\n\nseguido de:\n\n BUG: desreferencia de puntero NULL del kernel, direcci\u00f3n: 0000000000000008\n\ncon:\n\n RIP: 0010:iter_file_splice_write+0x3a4/0x520\n do_splice+0x197/0x4e0\n\no:\n\n RIP: 0010:pipe_buf_release (include/linux/pipe_fs_i.h:282)\n iter_file_splice_write (fs/splice.c:755)\n\nTambi\u00e9n se a\u00f1adi\u00f3 una verificaci\u00f3n de advertencia en splice para anunciar si ->write_iter() devolvi\u00f3 que hab\u00eda escrito m\u00e1s de lo que se le pidi\u00f3."}], "lastModified": "2026-10-19T21:10:00.160", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "489EF11B-3951-48B6-8DCA-E6B0DDAF7910", "versionEndExcluding": "6.12.44", "versionStartIncluding": "6.10"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "AFC28995-B8C3-4B68-8CB6-78E792B6629D", "versionEndExcluding": "6.16.4", "versionStartIncluding": "6.13"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.17:rc1:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "327D22EF-390B-454C-BD31-2ED23C998A1C"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.17:rc2:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C730CD9A-D969-4A8E-9522-162AAF7C0EE9"}], "operator": "OR"}]}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}