{"id":"CVE-2025-39723","state":"PUBLISHED","title":"netfs: Fix unbuffered write error handling","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nnetfs: Fix unbuffered write error handling\n\nIf all the subrequests in an unbuffered write stream fail, the subrequest\ncollector doesn't update the stream->transferred value and it retains its\ninitial LONG_MAX value.  Unfortunately, if all active streams fail, then we\ntake the smallest value of { LONG_MAX, LONG_MAX, ... } as the value to set\nin wreq->transferred - which is then returned from ->write_iter().\n\nLONG_MAX was chosen as the initial value so that all the streams can be\nquickly assessed by taking the smallest value of all stream->transferred -\nbut this only works if we've set any of them.\n\nFix this by adding a flag to indicate whether the value in\nstream->transferred is valid and checking that when we integrate the\nvalues.  stream->transferred can then be initialised to zero.\n\nThis was found by running the generic/750 xfstest against cifs with\ncache=none.  It splices data to the target file.  Once (if) it has used up\nall the available scratch space, the writes start failing with ENOSPC.\nThis causes ->write_iter() to fail.  However, it was returning\nwreq->transferred, i.e. LONG_MAX, rather than an error (because it thought\nthe amount transferred was non-zero) and iter_file_splice_write() would\nthen try to clean up that amount of pipe bufferage - leading to an oops\nwhen it overran.  The kernel log showed:\n\n    CIFS: VFS: Send error in write = -28\n\nfollowed by:\n\n    BUG: kernel NULL pointer dereference, address: 0000000000000008\n\nwith:\n\n    RIP: 0010:iter_file_splice_write+0x3a4/0x520\n    do_splice+0x197/0x4e0\n\nor:\n\n    RIP: 0010:pipe_buf_release (include/linux/pipe_fs_i.h:282)\n    iter_file_splice_write (fs/splice.c:755)\n\nAlso put a warning check into splice to announce if ->write_iter() returned\nthat it had written more than it was asked to.","publishedAt":"2025-09-05T17:21:31.137Z","updatedAt":"2026-08-05T12:04:52.373Z","severity":{"score":7.1,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H","source":"Linux"},"assigner":"Linux","products":["Linux Linux"],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"288ace2f57c9d06dd2e42bd80d03747d879a4068","status":"affected","lessThan":"f08c80af3c9a9849cd178b4843b7c01d103506a1","versionType":"git"},{"version":"288ace2f57c9d06dd2e42bd80d03747d879a4068","status":"affected","lessThan":"387164a2b97e1f5404c6d0049a7409bac7d2bc5b","versionType":"git"},{"version":"288ace2f57c9d06dd2e42bd80d03747d879a4068","status":"affected","lessThan":"a3de58b12ce074ec05b8741fa28d62ccb1070468","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["fs/netfs/read_collect.c","fs/netfs/write_collect.c","fs/netfs/write_issue.c","fs/splice.c","include/linux/netfs.h"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"6.10","status":"affected"},{"version":"0","status":"unaffected","lessThan":"6.10","versionType":"semver"},{"version":"6.12.44","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.16.4","status":"unaffected","lessThanOrEqual":"6.16.*","versionType":"semver"},{"version":"6.17","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["fs/netfs/read_collect.c","fs/netfs/write_collect.c","fs/netfs/write_issue.c","fs/splice.c","include/linux/netfs.h"]}],"references":["https://git.kernel.org/stable/c/f08c80af3c9a9849cd178b4843b7c01d103506a1","https://git.kernel.org/stable/c/387164a2b97e1f5404c6d0049a7409bac7d2bc5b","https://git.kernel.org/stable/c/a3de58b12ce074ec05b8741fa28d62ccb1070468"],"weaknesses":[],"ingestedAt":"2026-10-29T20:09:09.358Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2025/39xxx/CVE-2025-39723.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2025-39723","state":"PUBLISHED","datePublished":"2025-09-05T17:21:31.137Z","dateUpdated":"2026-08-05T12:04:52.373Z","assignerShortName":"Linux","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateReserved":"2025-04-16T07:20:57.117Z"},"containers":{"cna":{"title":"netfs: Fix unbuffered write error handling","descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnetfs: Fix unbuffered write error handling\n\nIf all the subrequests in an unbuffered write stream fail, the subrequest\ncollector doesn't update the stream->transferred value and it retains its\ninitial LONG_MAX value.  Unfortunately, if all active streams fail, then we\ntake the smallest value of { LONG_MAX, LONG_MAX, ... } as the value to set\nin wreq->transferred - which is then returned from ->write_iter().\n\nLONG_MAX was chosen as the initial value so that all the streams can be\nquickly assessed by taking the smallest value of all stream->transferred -\nbut this only works if we've set any of them.\n\nFix this by adding a flag to indicate whether the value in\nstream->transferred is valid and checking that when we integrate the\nvalues.  stream->transferred can then be initialised to zero.\n\nThis was found by running the generic/750 xfstest against cifs with\ncache=none.  It splices data to the target file.  Once (if) it has used up\nall the available scratch space, the writes start failing with ENOSPC.\nThis causes ->write_iter() to fail.  However, it was returning\nwreq->transferred, i.e. LONG_MAX, rather than an error (because it thought\nthe amount transferred was non-zero) and iter_file_splice_write() would\nthen try to clean up that amount of pipe bufferage - leading to an oops\nwhen it overran.  The kernel log showed:\n\n    CIFS: VFS: Send error in write = -28\n\nfollowed by:\n\n    BUG: kernel NULL pointer dereference, address: 0000000000000008\n\nwith:\n\n    RIP: 0010:iter_file_splice_write+0x3a4/0x520\n    do_splice+0x197/0x4e0\n\nor:\n\n    RIP: 0010:pipe_buf_release (include/linux/pipe_fs_i.h:282)\n    iter_file_splice_write (fs/splice.c:755)\n\nAlso put a warning check into splice to announce if ->write_iter() returned\nthat it had written more than it was asked to."}],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"288ace2f57c9d06dd2e42bd80d03747d879a4068","status":"affected","lessThan":"f08c80af3c9a9849cd178b4843b7c01d103506a1","versionType":"git"},{"version":"288ace2f57c9d06dd2e42bd80d03747d879a4068","status":"affected","lessThan":"387164a2b97e1f5404c6d0049a7409bac7d2bc5b","versionType":"git"},{"version":"288ace2f57c9d06dd2e42bd80d03747d879a4068","status":"affected","lessThan":"a3de58b12ce074ec05b8741fa28d62ccb1070468","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["fs/netfs/read_collect.c","fs/netfs/write_collect.c","fs/netfs/write_issue.c","fs/splice.c","include/linux/netfs.h"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"6.10","status":"affected"},{"version":"0","status":"unaffected","lessThan":"6.10","versionType":"semver"},{"version":"6.12.44","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.16.4","status":"unaffected","lessThanOrEqual":"6.16.*","versionType":"semver"},{"version":"6.17","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["fs/netfs/read_collect.c","fs/netfs/write_collect.c","fs/netfs/write_issue.c","fs/splice.c","include/linux/netfs.h"]}],"references":[{"url":"https://git.kernel.org/stable/c/f08c80af3c9a9849cd178b4843b7c01d103506a1"},{"url":"https://git.kernel.org/stable/c/387164a2b97e1f5404c6d0049a7409bac7d2bc5b"},{"url":"https://git.kernel.org/stable/c/a3de58b12ce074ec05b8741fa28d62ccb1070468"}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H","baseScore":7.1,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:N - The netfs write collector processes write results derived from a remote SMB/9p server's responses, and the arming condition (every write subrequest failing) is entirely under the remote server's control — a malicious, compromised, or MITM'd file server simply returns STATUS_DISK_FULL/ACCESS_DENIED for the writes and the client kernel oopses. The vulnerable component is bound to the network stack via the cifs/9p transport.\nAC:L - The failure is deterministic: LONG_MAX always exceeds the total bytes held in the pipe, so the splice cleanup loop unconditionally runs past the valid buffers into a slot with NULL ops and faults. No race, no memory-layout dependency, no non-default config (cifs/9p with cache=none, or any O_DIRECT open).\nPR:N - A remote file server needs no credentials or privileges on the victim client to return write errors; in the equivalent local framing an ordinary unprivileged user with write access to the mount triggers it via splice()/cp with no capabilities at all.\nUI:R - The remote attacker cannot initiate the transfer itself — a client-side process must perform a splice-based write (splice/sendfile/copy_file_range, e.g. a routine `cp` onto the mounted share) for the bogus LONG_MAX return to reach iter_file_splice_write().\nS:U - The corruption and crash are confined to the kernel of the affected host; no VM, IOMMU, or sandbox boundary is crossed.\nC:N - The fault is a NULL function-pointer dereference and pipe-ring state corruption; it yields no read primitive and discloses no kernel or file data to the attacker.\nI:L - ->write_iter() reports 0x7fffffffffffffff bytes written when nothing was written, so applications treat failed writes as successful (silent data loss), netfs_update_i_size() stamps a bogus/overflowed size onto the client inode, and the splice loop destroys unwritten pipe contents and leaves pipe->tail past pipe->head — limited, non-arbitrary data and metadata corruption.\nA:H - Reliable kernel NULL pointer dereference oops in iter_file_splice_write()/pipe_buf_release(), taken with the pipe mutex held, so the pipe is permanently locked and any other user of it hangs in D state; on panic_on_oops configurations it is a full system panic."}]}],"providerMetadata":{"shortName":"Linux","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateUpdated":"2026-08-05T12:04:52.373Z"},"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.10","versionEndExcluding":"6.12.44"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.10","versionEndExcluding":"6.16.4"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.10","versionEndExcluding":"6.17"}]}]}],"x_generator":{"engine":"bippy-1.2.0"}}}}}