{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2025-39723","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","state":"PUBLISHED","assignerShortName":"Linux","dateReserved":"2025-04-16T07:20:57.117Z","datePublished":"2025-09-05T17:21:31.137Z","dateUpdated":"2026-08-05T12:04:52.373Z"},"containers":{"cna":{"providerMetadata":{"orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux","dateUpdated":"2026-08-05T12:04:52.373Z"},"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnetfs: Fix unbuffered write error handling\n\nIf all the subrequests in an unbuffered write stream fail, the subrequest\ncollector doesn't update the stream->transferred value and it retains its\ninitial LONG_MAX value.  Unfortunately, if all active streams fail, then we\ntake the smallest value of { LONG_MAX, LONG_MAX, ... } as the value to set\nin wreq->transferred - which is then returned from ->write_iter().\n\nLONG_MAX was chosen as the initial value so that all the streams can be\nquickly assessed by taking the smallest value of all stream->transferred -\nbut this only works if we've set any of them.\n\nFix this by adding a flag to indicate whether the value in\nstream->transferred is valid and checking that when we integrate the\nvalues.  stream->transferred can then be initialised to zero.\n\nThis was found by running the generic/750 xfstest against cifs with\ncache=none.  It splices data to the target file.  Once (if) it has used up\nall the available scratch space, the writes start failing with ENOSPC.\nThis causes ->write_iter() to fail.  However, it was returning\nwreq->transferred, i.e. LONG_MAX, rather than an error (because it thought\nthe amount transferred was non-zero) and iter_file_splice_write() would\nthen try to clean up that amount of pipe bufferage - leading to an oops\nwhen it overran.  The kernel log showed:\n\n    CIFS: VFS: Send error in write = -28\n\nfollowed by:\n\n    BUG: kernel NULL pointer dereference, address: 0000000000000008\n\nwith:\n\n    RIP: 0010:iter_file_splice_write+0x3a4/0x520\n    do_splice+0x197/0x4e0\n\nor:\n\n    RIP: 0010:pipe_buf_release (include/linux/pipe_fs_i.h:282)\n    iter_file_splice_write (fs/splice.c:755)\n\nAlso put a warning check into splice to announce if ->write_iter() returned\nthat it had written more than it was asked to."}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H","baseScore":7.1,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:N - The netfs write collector processes write results derived from a remote SMB/9p server's responses, and the arming condition (every write subrequest failing) is entirely under the remote server's control — a malicious, compromised, or MITM'd file server simply returns STATUS_DISK_FULL/ACCESS_DENIED for the writes and the client kernel oopses. The vulnerable component is bound to the network stack via the cifs/9p transport.\nAC:L - The failure is deterministic: LONG_MAX always exceeds the total bytes held in the pipe, so the splice cleanup loop unconditionally runs past the valid buffers into a slot with NULL ops and faults. No race, no memory-layout dependency, no non-default config (cifs/9p with cache=none, or any O_DIRECT open).\nPR:N - A remote file server needs no credentials or privileges on the victim client to return write errors; in the equivalent local framing an ordinary unprivileged user with write access to the mount triggers it via splice()/cp with no capabilities at all.\nUI:R - The remote attacker cannot initiate the transfer itself — a client-side process must perform a splice-based write (splice/sendfile/copy_file_range, e.g. a routine `cp` onto the mounted share) for the bogus LONG_MAX return to reach iter_file_splice_write().\nS:U - The corruption and crash are confined to the kernel of the affected host; no VM, IOMMU, or sandbox boundary is crossed.\nC:N - The fault is a NULL function-pointer dereference and pipe-ring state corruption; it yields no read primitive and discloses no kernel or file data to the attacker.\nI:L - ->write_iter() reports 0x7fffffffffffffff bytes written when nothing was written, so applications treat failed writes as successful (silent data loss), netfs_update_i_size() stamps a bogus/overflowed size onto the client inode, and the splice loop destroys unwritten pipe contents and leaves pipe->tail past pipe->head — limited, non-arbitrary data and metadata corruption.\nA:H - Reliable kernel NULL pointer dereference oops in iter_file_splice_write()/pipe_buf_release(), taken with the pipe mutex held, so the pipe is permanently locked and any other user of it hangs in D state; on panic_on_oops configurations it is a full system panic."}]}],"affected":[{"product":"Linux","vendor":"Linux","defaultStatus":"unaffected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["fs/netfs/read_collect.c","fs/netfs/write_collect.c","fs/netfs/write_issue.c","fs/splice.c","include/linux/netfs.h"],"versions":[{"version":"288ace2f57c9d06dd2e42bd80d03747d879a4068","lessThan":"f08c80af3c9a9849cd178b4843b7c01d103506a1","status":"affected","versionType":"git"},{"version":"288ace2f57c9d06dd2e42bd80d03747d879a4068","lessThan":"387164a2b97e1f5404c6d0049a7409bac7d2bc5b","status":"affected","versionType":"git"},{"version":"288ace2f57c9d06dd2e42bd80d03747d879a4068","lessThan":"a3de58b12ce074ec05b8741fa28d62ccb1070468","status":"affected","versionType":"git"}]},{"product":"Linux","vendor":"Linux","defaultStatus":"affected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["fs/netfs/read_collect.c","fs/netfs/write_collect.c","fs/netfs/write_issue.c","fs/splice.c","include/linux/netfs.h"],"versions":[{"version":"6.10","status":"affected"},{"version":"0","lessThan":"6.10","status":"unaffected","versionType":"semver"},{"version":"6.12.44","lessThanOrEqual":"6.12.*","status":"unaffected","versionType":"semver"},{"version":"6.16.4","lessThanOrEqual":"6.16.*","status":"unaffected","versionType":"semver"},{"version":"6.17","lessThanOrEqual":"*","status":"unaffected","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.10","versionEndExcluding":"6.12.44"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.10","versionEndExcluding":"6.16.4"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.10","versionEndExcluding":"6.17"}]}]}],"references":[{"url":"https://git.kernel.org/stable/c/f08c80af3c9a9849cd178b4843b7c01d103506a1"},{"url":"https://git.kernel.org/stable/c/387164a2b97e1f5404c6d0049a7409bac7d2bc5b"},{"url":"https://git.kernel.org/stable/c/a3de58b12ce074ec05b8741fa28d62ccb1070468"}],"title":"netfs: Fix unbuffered write error handling","x_generator":{"engine":"bippy-1.2.0"}}}}