CVE-2025-39697: NFS: Fix a race when updating an existing write

Severity: medium (CVSS 4.7 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-09-05 · updated 2026-10-19
Weakness: CWE-362

Description

In the Linux kernel, the following vulnerability has been resolved: NFS: Fix a race when updating an existing write After nfs_lock_and_join_requests() tests for whether the request is still attached to the mapping, nothing prevents a call to nfs_inode_remove_request() from succeeding until we actually lock the page group. The reason is that whoever called nfs_inode_remove_request() doesn't necessarily have a lock on the page group head. So in order to avoid races, let's take the page group lock earlier in nfs_lock_and_join_requests(), and hold it across the removal of the request in nfs_inode_remove_request().

Affected products

Debian Linux: 11.0
Linux kernel: from 4.14 before 5.10.242; from 5.11 before 5.15.191; from 5.16 before 6.1.150; from 6.2 before 6.6.104; from 6.7 before 6.12.44; from 6.13 before 6.16.4 — fixed in 5.10.242, 5.15.191, 6.1.150, 6.12.44, 6.16.4, 6.6.104

How to fix

Upgrade to a fixed version: Linux kernel 5.10.242, 5.15.191, 6.1.150, 6.12.44. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2025-39697 or the next vulnerability affects your stack