CVE-2025-39912

MEDIUM5.5

nfs/localio: restore creds before releasing pageio data

Published Oct 1, 2025

Modified 2 months ago

Details

In the Linux kernel, the following vulnerability has been resolved:

nfs/localio: restore creds before releasing pageio data

Otherwise if the nfsd filecache code releases the nfsd_file immediately, it can trigger the BUG_ON(cred == current->cred) in __put_cred() when it puts the nfsd_file->nf_file->f-cred.

References

WEB

https://git.kernel.org/stable/c/57c1bb02b4fc8eec6eb01736e7fad26dffacf18c

WEB

https://git.kernel.org/stable/c/992203a1fba51b025c60ec0c8b0d9223343dea95

WEB

https://git.kernel.org/stable/c/c250be1d75bf80dc5ab46f0b434b746c1868a1ea

ADVISORY

https://www.cve.org/CVERecord?id=CVE-2025-39912

CVSS Analysis

CVSS v3.1

5.5

Exploitability

Attack Vector

LocalAV:L

Attack Complexity

LowAC:L

Privileges Required

LowPR:L

User Interaction

NoneUI:N

Scope

UnchangedS:U

Impact

Confidentiality

NoneC:N

Integrity

NoneI:N

Availability

HighA:H

5.5/CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Ecosystems

Timeline

PublishedOct 1, 2025

ModifiedMay 11, 2026