{"id":69584,"date":"2025-09-05T23:32:14","date_gmt":"2025-09-05T20:02:14","guid":{"rendered":"https:\/\/afaghhosting.net\/blog\/cve-2025-39723-netfs-fix-unbuffered-write-error-handling\/"},"modified":"2025-09-05T23:32:14","modified_gmt":"2025-09-05T20:02:14","slug":"cve-2025-39723-netfs-fix-unbuffered-write-error-handling","status":"publish","type":"post","link":"https:\/\/afaghhosting.net\/blog\/cve-2025-39723-netfs-fix-unbuffered-write-error-handling\/","title":{"rendered":"CVE-2025-39723 &#8211; netfs: Fix unbuffered write error handling"},"content":{"rendered":"<p><strong>CVE ID : <\/strong>CVE-2025-39723<br \/>\n<br \/>\n<strong>Published : <\/strong> Sept. 5, 2025, 6:15 p.m. | 1\u00a0hour ago<br \/>\n<br \/>\n<strong>Description : <\/strong>In the Linux kernel, the following vulnerability has been resolved:<\/p>\n<p>netfs: Fix unbuffered write error handling<\/p>\n<p>If all the subrequests in an unbuffered write stream fail, the subrequest<br \/>\ncollector doesn&#8217;t update the stream-&gt;transferred value and it retains its<br \/>\ninitial LONG_MAX value.  Unfortunately, if all active streams fail, then we<br \/>\ntake the smallest value of { LONG_MAX, LONG_MAX, &#8230; } as the value to set<br \/>\nin wreq-&gt;transferred &#8211; which is then returned from -&gt;write_iter().<\/p>\n<p>LONG_MAX was chosen as the initial value so that all the streams can be<br \/>\nquickly assessed by taking the smallest value of all stream-&gt;transferred &#8211;<br \/>\nbut this only works if we&#8217;ve set any of them.<\/p>\n<p>Fix this by adding a flag to indicate whether the value in<br \/>\nstream-&gt;transferred is valid and checking that when we integrate the<br \/>\nvalues.  stream-&gt;transferred can then be initialised to zero.<\/p>\n<p>This was found by running the generic\/750 xfstest against cifs with<br \/>\ncache=none.  It splices data to the target file.  Once (if) it has used up<br \/>\nall the available scratch space, the writes start failing with ENOSPC.<br \/>\nThis causes -&gt;write_iter() to fail.  However, it was returning<br \/>\nwreq-&gt;transferred, i.e. LONG_MAX, rather than an error (because it thought<br \/>\nthe amount transferred was non-zero) and iter_file_splice_write() would<br \/>\nthen try to clean up that amount of pipe bufferage &#8211; leading to an oops<br \/>\nwhen it overran.  The kernel log showed:<\/p>\n<p>    CIFS: VFS: Send error in write = -28<\/p>\n<p>followed by:<\/p>\n<p>    BUG: kernel NULL pointer dereference, address: 0000000000000008<\/p>\n<p>with:<\/p>\n<p>    RIP: 0010:iter_file_splice_write+0x3a4\/0x520<br \/>\n    do_splice+0x197\/0x4e0<\/p>\n<p>or:<\/p>\n<p>    RIP: 0010:pipe_buf_release (include\/linux\/pipe_fs_i.h:282)<br \/>\n    iter_file_splice_write (fs\/splice.c:755)<\/p>\n<p>Also put a warning check into splice to announce if -&gt;write_iter() returned<br \/>\nthat it had written more than it was asked to.<br \/>\n<br \/>\n<strong>Severity:<\/strong> 0.0 | NA<br \/>\n<br \/>\nVisit the link for more details, such as CVSS details, affected products, timeline, and more&#8230;<\/p>\n","protected":false},"excerpt":{"rendered":"<p>CVE ID : CVE-2025-39723 Published : Sept. 5, 2025, 6:15 p.m. | 1\u00a0hour ago Description : In the Linux kernel, the following vulnerability has been resolved: netfs: Fix unbuffered write error handling If all the subrequests in an unbuffered write stream fail, the subrequest collector doesn&#8217;t update the stream-&gt;transferred value and it retains its initial &hellip;<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[26],"tags":[],"class_list":["post-69584","post","type-post","status-publish","format-standard","hentry","category-vulnerability"],"_links":{"self":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts\/69584","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/comments?post=69584"}],"version-history":[{"count":0,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts\/69584\/revisions"}],"wp:attachment":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/media?parent=69584"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/categories?post=69584"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/tags?post=69584"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}