{"id":"CVE-2025-39723","summary":"netfs: Fix unbuffered write error handling","details":"In the Linux kernel, the following vulnerability has been resolved:\n\nnetfs: Fix unbuffered write error handling\n\nIf all the subrequests in an unbuffered write stream fail, the subrequest\ncollector doesn't update the stream-\u003etransferred value and it retains its\ninitial LONG_MAX value.  Unfortunately, if all active streams fail, then we\ntake the smallest value of { LONG_MAX, LONG_MAX, ... } as the value to set\nin wreq-\u003etransferred - which is then returned from -\u003ewrite_iter().\n\nLONG_MAX was chosen as the initial value so that all the streams can be\nquickly assessed by taking the smallest value of all stream-\u003etransferred -\nbut this only works if we've set any of them.\n\nFix this by adding a flag to indicate whether the value in\nstream-\u003etransferred is valid and checking that when we integrate the\nvalues.  stream-\u003etransferred can then be initialised to zero.\n\nThis was found by running the generic/750 xfstest against cifs with\ncache=none.  It splices data to the target file.  Once (if) it has used up\nall the available scratch space, the writes start failing with ENOSPC.\nThis causes -\u003ewrite_iter() to fail.  However, it was returning\nwreq-\u003etransferred, i.e. LONG_MAX, rather than an error (because it thought\nthe amount transferred was non-zero) and iter_file_splice_write() would\nthen try to clean up that amount of pipe bufferage - leading to an oops\nwhen it overran.  The kernel log showed:\n\n    CIFS: VFS: Send error in write = -28\n\nfollowed by:\n\n    BUG: kernel NULL pointer dereference, address: 0000000000000008\n\nwith:\n\n    RIP: 0010:iter_file_splice_write+0x3a4/0x520\n    do_splice+0x197/0x4e0\n\nor:\n\n    RIP: 0010:pipe_buf_release (include/linux/pipe_fs_i.h:282)\n    iter_file_splice_write (fs/splice.c:755)\n\nAlso put a warning check into splice to announce if -\u003ewrite_iter() returned\nthat it had written more than it was asked to.","modified":"2026-03-20T12:43:01.566776Z","published":"2025-09-05T17:21:31.137Z","related":["SUSE-SU-2025:21074-1","SUSE-SU-2025:21139-1","SUSE-SU-2025:21179-1","openSUSE-SU-2025:20081-1"],"database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/39xxx/CVE-2025-39723.json","cna_assigner":"Linux"},"references":[{"type":"WEB","url":"https://git.kernel.org/stable/c/387164a2b97e1f5404c6d0049a7409bac7d2bc5b"},{"type":"WEB","url":"https://git.kernel.org/stable/c/a3de58b12ce074ec05b8741fa28d62ccb1070468"},{"type":"WEB","url":"https://git.kernel.org/stable/c/f08c80af3c9a9849cd178b4843b7c01d103506a1"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/39xxx/CVE-2025-39723.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-39723"},{"type":"PACKAGE","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"288ace2f57c9d06dd2e42bd80d03747d879a4068"},{"fixed":"f08c80af3c9a9849cd178b4843b7c01d103506a1"},{"fixed":"387164a2b97e1f5404c6d0049a7409bac7d2bc5b"},{"fixed":"a3de58b12ce074ec05b8741fa28d62ccb1070468"}]}],"database_specific":{"source":"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2025-39723.json"}}],"schema_version":"1.7.5"}