GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2025-38139 (GCVE-0-2025-38139)

Vulnerability from cvelistv5 – Published: 2025-07-03 08:35 – Updated: 2026-08-05 11:59
VLAI
Title
netfs: Fix oops in write-retry from mis-resetting the subreq iterator
Summary
In the Linux kernel, the following vulnerability has been resolved: netfs: Fix oops in write-retry from mis-resetting the subreq iterator Fix the resetting of the subrequest iterator in netfs_retry_write_stream() to use the iterator-reset function as the iterator may have been shortened by a previous retry. In such a case, the amount of data to be written by the subrequest is not "subreq->len" but "subreq->len - subreq->transferred". Without this, KASAN may see an error in iov_iter_revert(): BUG: KASAN: slab-out-of-bounds in iov_iter_revert lib/iov_iter.c:633 [inline] BUG: KASAN: slab-out-of-bounds in iov_iter_revert+0x443/0x5a0 lib/iov_iter.c:611 Read of size 4 at addr ffff88802912a0b8 by task kworker/u32:7/1147 CPU: 1 UID: 0 PID: 1147 Comm: kworker/u32:7 Not tainted 6.15.0-rc6-syzkaller-00052-g9f35e33144ae #0 PREEMPT(full) Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 Workqueue: events_unbound netfs_write_collection_worker Call Trace: <TASK> __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:408 [inline] print_report+0xc3/0x670 mm/kasan/report.c:521 kasan_report+0xe0/0x110 mm/kasan/report.c:634 iov_iter_revert lib/iov_iter.c:633 [inline] iov_iter_revert+0x443/0x5a0 lib/iov_iter.c:611 netfs_retry_write_stream fs/netfs/write_retry.c:44 [inline] netfs_retry_writes+0x166d/0x1a50 fs/netfs/write_retry.c:231 netfs_collect_write_results fs/netfs/write_collect.c:352 [inline] netfs_write_collection_worker+0x23fd/0x3830 fs/netfs/write_collect.c:374 process_one_work+0x9cf/0x1b70 kernel/workqueue.c:3238 process_scheduled_works kernel/workqueue.c:3319 [inline] worker_thread+0x6c8/0xf10 kernel/workqueue.c:3400 kthread+0x3c2/0x780 kernel/kthread.c:464 ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:153 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 </TASK>
Severity
9.8 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: cd0277ed0c188dd40e7744e89299af7b78831ca4 , < e0fefe9bc07e6101fdc57abda3644f296c114e31 (git)
Affected: cd0277ed0c188dd40e7744e89299af7b78831ca4 , < bd0edaf99a920b1a9decd773179caacacb61d0fd (git)
Affected: cd0277ed0c188dd40e7744e89299af7b78831ca4 , < 4481f7f2b3df123ec77e828c849138f75cff2bf2 (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.12
Unaffected: 0 , < 6.12 (semver)
Unaffected: 6.12.37 , ≤ 6.12.* (semver)
Unaffected: 6.15.3 , ≤ 6.15.* (semver)
Unaffected: 6.16 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/netfs/write_retry.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "e0fefe9bc07e6101fdc57abda3644f296c114e31",
              "status": "affected",
              "version": "cd0277ed0c188dd40e7744e89299af7b78831ca4",
              "versionType": "git"
            },
            {
              "lessThan": "bd0edaf99a920b1a9decd773179caacacb61d0fd",
              "status": "affected",
              "version": "cd0277ed0c188dd40e7744e89299af7b78831ca4",
              "versionType": "git"
            },
            {
              "lessThan": "4481f7f2b3df123ec77e828c849138f75cff2bf2",
              "status": "affected",
              "version": "cd0277ed0c188dd40e7744e89299af7b78831ca4",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/netfs/write_retry.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.12"
            },
            {
              "lessThan": "6.12",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.37",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.15.*",
              "status": "unaffected",
              "version": "6.15.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.16",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.37",
                  "versionStartIncluding": "6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.15.3",
                  "versionStartIncluding": "6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.16",
                  "versionStartIncluding": "6.12",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfs: Fix oops in write-retry from mis-resetting the subreq iterator\n\nFix the resetting of the subrequest iterator in netfs_retry_write_stream()\nto use the iterator-reset function as the iterator may have been shortened\nby a previous retry.  In such a case, the amount of data to be written by\nthe subrequest is not \"subreq-\u003elen\" but \"subreq-\u003elen -\nsubreq-\u003etransferred\".\n\nWithout this, KASAN may see an error in iov_iter_revert():\n\n   BUG: KASAN: slab-out-of-bounds in iov_iter_revert lib/iov_iter.c:633 [inline]\n   BUG: KASAN: slab-out-of-bounds in iov_iter_revert+0x443/0x5a0 lib/iov_iter.c:611\n   Read of size 4 at addr ffff88802912a0b8 by task kworker/u32:7/1147\n\n   CPU: 1 UID: 0 PID: 1147 Comm: kworker/u32:7 Not tainted 6.15.0-rc6-syzkaller-00052-g9f35e33144ae #0 PREEMPT(full)\n   Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014\n   Workqueue: events_unbound netfs_write_collection_worker\n   Call Trace:\n    \u003cTASK\u003e\n    __dump_stack lib/dump_stack.c:94 [inline]\n    dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:120\n    print_address_description mm/kasan/report.c:408 [inline]\n    print_report+0xc3/0x670 mm/kasan/report.c:521\n    kasan_report+0xe0/0x110 mm/kasan/report.c:634\n    iov_iter_revert lib/iov_iter.c:633 [inline]\n    iov_iter_revert+0x443/0x5a0 lib/iov_iter.c:611\n    netfs_retry_write_stream fs/netfs/write_retry.c:44 [inline]\n    netfs_retry_writes+0x166d/0x1a50 fs/netfs/write_retry.c:231\n    netfs_collect_write_results fs/netfs/write_collect.c:352 [inline]\n    netfs_write_collection_worker+0x23fd/0x3830 fs/netfs/write_collect.c:374\n    process_one_work+0x9cf/0x1b70 kernel/workqueue.c:3238\n    process_scheduled_works kernel/workqueue.c:3319 [inline]\n    worker_thread+0x6c8/0xf10 kernel/workqueue.c:3400\n    kthread+0x3c2/0x780 kernel/kthread.c:464\n    ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:153\n    ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245\n    \u003c/TASK\u003e"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The trigger is entirely under the control of the remote 9p server, which drives the retry path by reporting short byte counts in its RWRITE replies; the 9p client supports trans=tcp/trans=rdma to a remote peer and the protocol is unauthenticated and unencrypted by default, so an on-path attacker can inject the same replies.\nAC:L - Exploitation is fully deterministic \u2014 the server simply answers two consecutive TWRITEs on the same subrequest with a partial count, and the second retry over-reverts the iterator by an attacker-chosen amount; there is no race, timing window, or uncontrollable memory-layout precondition.\nPR:N - The malicious or compromised 9p server (or an on-path attacker on plaintext 9p/TCP) holds no credentials on the victim client, and 9p mounts are typically established with no authentication at all.\nUI:N - No per-instance victim action is needed: on an existing 9p mount, ordinary file writes and background writeback from the kworker reach the retry path, and the server alone decides when to emit the short write that arms it.\nS:U - The out-of-bounds access and the resulting corrupted iterator stay within the kernel\u0027s own security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - iov_iter_revert() reads out of bounds backwards off the kvmalloc\u0027d bvec array (or off the head of the folio_queue chain) by an attacker-chosen distance, and the resulting forged bio_vec makes the client transmit memory pointed to by an adjacent-heap page pointer straight to the attacker-controlled server, yielding arbitrary kernel memory disclosure.\nI:H - The corrupted iterator carries bv_page/bv_len values sourced from attacker-groomable adjacent heap memory (or a stale/freed folio_queue), so subsequent I/O submission and page reference get/put operate on arbitrary struct page pointers, giving refcount corruption and a path to control-flow hijack.\nA:H - The bug is a confirmed oops \u2014 syzbot reproduced a KASAN slab-out-of-bounds in iov_iter_revert() from netfs_write_collection_worker, and the unbounded backwards walk readily runs off the slab or dereferences a NULL folioq-\u003eprev, panicking the kernel."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:59:50.138Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/e0fefe9bc07e6101fdc57abda3644f296c114e31"
        },
        {
          "url": "https://git.kernel.org/stable/c/bd0edaf99a920b1a9decd773179caacacb61d0fd"
        },
        {
          "url": "https://git.kernel.org/stable/c/4481f7f2b3df123ec77e828c849138f75cff2bf2"
        }
      ],
      "title": "netfs: Fix oops in write-retry from mis-resetting the subreq iterator",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-38139",
    "datePublished": "2025-07-03T08:35:41.271Z",
    "dateReserved": "2025-04-16T04:51:23.987Z",
    "dateUpdated": "2026-08-05T11:59:50.138Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-38139",
      "date": "2026-09-16",
      "epss": "0.00391",
      "percentile": "0.32879"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-38139\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-07-03T09:15:28.500\",\"lastModified\":\"2026-07-30T06:22:54.727\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nnetfs: Fix oops in write-retry from mis-resetting the subreq iterator\\n\\nFix the resetting of the subrequest iterator in netfs_retry_write_stream()\\nto use the iterator-reset function as the iterator may have been shortened\\nby a previous retry.  In such a case, the amount of data to be written by\\nthe subrequest is not \\\"subreq-\u003elen\\\" but \\\"subreq-\u003elen -\\nsubreq-\u003etransferred\\\".\\n\\nWithout this, KASAN may see an error in iov_iter_revert():\\n\\n   BUG: KASAN: slab-out-of-bounds in iov_iter_revert lib/iov_iter.c:633 [inline]\\n   BUG: KASAN: slab-out-of-bounds in iov_iter_revert+0x443/0x5a0 lib/iov_iter.c:611\\n   Read of size 4 at addr ffff88802912a0b8 by task kworker/u32:7/1147\\n\\n   CPU: 1 UID: 0 PID: 1147 Comm: kworker/u32:7 Not tainted 6.15.0-rc6-syzkaller-00052-g9f35e33144ae #0 PREEMPT(full)\\n   Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014\\n   Workqueue: events_unbound netfs_write_collection_worker\\n   Call Trace:\\n    \u003cTASK\u003e\\n    __dump_stack lib/dump_stack.c:94 [inline]\\n    dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:120\\n    print_address_description mm/kasan/report.c:408 [inline]\\n    print_report+0xc3/0x670 mm/kasan/report.c:521\\n    kasan_report+0xe0/0x110 mm/kasan/report.c:634\\n    iov_iter_revert lib/iov_iter.c:633 [inline]\\n    iov_iter_revert+0x443/0x5a0 lib/iov_iter.c:611\\n    netfs_retry_write_stream fs/netfs/write_retry.c:44 [inline]\\n    netfs_retry_writes+0x166d/0x1a50 fs/netfs/write_retry.c:231\\n    netfs_collect_write_results fs/netfs/write_collect.c:352 [inline]\\n    netfs_write_collection_worker+0x23fd/0x3830 fs/netfs/write_collect.c:374\\n    process_one_work+0x9cf/0x1b70 kernel/workqueue.c:3238\\n    process_scheduled_works kernel/workqueue.c:3319 [inline]\\n    worker_thread+0x6c8/0xf10 kernel/workqueue.c:3400\\n    kthread+0x3c2/0x780 kernel/kthread.c:464\\n    ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:153\\n    ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245\\n    \u003c/TASK\u003e\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: netfs: Se corrige un error en el reintento de escritura debido al restablecimiento incorrecto del iterador de la subsolicitud. Se corrige el restablecimiento del iterador de la subsolicitud en netfs_retry_write_stream() para usar la funci\u00f3n iterator-reset, ya que el iterador podr\u00eda haberse acortado debido a un reintento anterior. En tal caso, la cantidad de datos que debe escribir la subsolicitud no es \\\"subreq-\u0026gt;len\\\", sino \\\"subreq-\u0026gt;len - subreq-\u0026gt;transferred\\\". Sin esto, KASAN puede ver un error en iov_iter_revert(): ERROR: KASAN: slab-out-of-bounds en iov_iter_revert lib/iov_iter.c:633 [en l\u00ednea] ERROR: KASAN: slab-out-of-bounds en iov_iter_revert+0x443/0x5a0 lib/iov_iter.c:611 Lectura de tama\u00f1o 4 en la direcci\u00f3n ffff88802912a0b8 por la tarea kworker/u32:7/1147 CPU: 1 UID: 0 PID: 1147 Comm: kworker/u32:7 No contaminado 6.15.0-rc6-syzkaller-00052-g9f35e33144ae #0 PREEMPT(full) Nombre del hardware: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 01/04/2014 Cola de trabajo: events_unbound netfs_write_collection_worker Rastreo de llamadas  __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:408 [inline] print_report+0xc3/0x670 mm/kasan/report.c:521 kasan_report+0xe0/0x110 mm/kasan/report.c:634 iov_iter_revert lib/iov_iter.c:633 [inline] iov_iter_revert+0x443/0x5a0 lib/iov_iter.c:611 netfs_retry_write_stream fs/netfs/write_retry.c:44 [inline] netfs_retry_writes+0x166d/0x1a50 fs/netfs/write_retry.c:231 netfs_collect_write_results fs/netfs/write_collect.c:352 [inline] netfs_write_collection_worker+0x23fd/0x3830 fs/netfs/write_collect.c:374 process_one_work+0x9cf/0x1b70 kernel/workqueue.c:3238 process_scheduled_works kernel/workqueue.c:3319 [inline] worker_thread+0x6c8/0xf10 kernel/workqueue.c:3400 kthread+0x3c2/0x780 kernel/kthread.c:464 ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:153 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245  \"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"fs/netfs/write_retry.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"cd0277ed0c188dd40e7744e89299af7b78831ca4\",\"lessThan\":\"e0fefe9bc07e6101fdc57abda3644f296c114e31\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"cd0277ed0c188dd40e7744e89299af7b78831ca4\",\"lessThan\":\"bd0edaf99a920b1a9decd773179caacacb61d0fd\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"cd0277ed0c188dd40e7744e89299af7b78831ca4\",\"lessThan\":\"4481f7f2b3df123ec77e828c849138f75cff2bf2\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"fs/netfs/write_retry.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.12\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.12\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.37\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.15.3\",\"lessThanOrEqual\":\"6.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.16\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":9.8,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":5.9},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H\",\"baseScore\":7.1,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.2}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-125\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.12\",\"versionEndExcluding\":\"6.12.37\",\"matchCriteriaId\":\"F15EFAD5-C9E3-4C87-9DC6-6867D90AAB3A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.13\",\"versionEndExcluding\":\"6.15.3\",\"matchCriteriaId\":\"0541C761-BD5E-4C1A-8432-83B375D7EB92\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/4481f7f2b3df123ec77e828c849138f75cff2bf2\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/bd0edaf99a920b1a9decd773179caacacb61d0fd\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/e0fefe9bc07e6101fdc57abda3644f296c114e31\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "None",
      "current_release_date": "2026-06-30T10:26:36+00:00",
      "cve": "CVE-2025-38139",
      "id": "CVE-2025-38139",
      "initial_release_date": "2025-07-03T00:00:00+00:00",
      "product_status:known_not_affected": "274",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: netfs: Fix oops in write-retry from mis-resetting the subreq iterator",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-38139.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-08-29T01:20:06Z",
      "cve": "CVE-2025-38139",
      "id": "CVE-2025-38139",
      "initial_release_date": "2025-07-03T23:23:10Z",
      "product_status:known_not_affected": "524",
      "product_status:recommended": "78",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2025-38139",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2025-38139.json",
      "version": "13"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.