CVE-2025-39697

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-39697
In the Linux kernel, the following vulnerability has been resolved: NFS: Fix a race when updating an existing write After nfs_lock_and_join_requests() tests for whether the request is still attached to the mapping, nothing prevents a call to nfs_inode_remove_request() from succeeding until we actually lock the page group. The reason is that whoever called nfs_inode_remove_request() doesn't necessarily have a lock on the page group head. So in order to avoid races, let's take the page group lock earlier in nfs_lock_and_join_requests(), and hold it across the removal of the request in nfs_inode_remove_request().

4.7 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.0 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity HIGH

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://git.kernel.org/stable/c/0ff42a32784e0f2cb46a46da8e9f473538c13e1b Patch
https://git.kernel.org/stable/c/181feb41f0b268e6288bf9a7b984624d7fe2031d Patch
https://git.kernel.org/stable/c/202a3432d21ac060629a760fff3b0a39859da3ea Patch
https://git.kernel.org/stable/c/76d2e3890fb169168c73f2e4f8375c7cc24a765e Patch
https://git.kernel.org/stable/c/92278ae36935a54e65fef9f8ea8efe7e80481ace Patch
https://git.kernel.org/stable/c/c32e3c71aaa1c1ba05da88605e2ddd493c58794f Patch
https://git.kernel.org/stable/c/f230d40147cc37eb3aef4d50e2e2c06ea73d9a77 Patch
https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html Third Party Advisory Mailing List
https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html Third Party Advisory Mailing List
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.17:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.17:rc2:*:*:*:*:*:*

Configuration 2 (hide)

cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*
History

08 Jan 2026, 16:09

Type Values Removed Values Added
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 4.7
CWE CWE-362
References () https://git.kernel.org/stable/c/0ff42a32784e0f2cb46a46da8e9f473538c13e1b - () https://git.kernel.org/stable/c/0ff42a32784e0f2cb46a46da8e9f473538c13e1b - Patch
References () https://git.kernel.org/stable/c/181feb41f0b268e6288bf9a7b984624d7fe2031d - () https://git.kernel.org/stable/c/181feb41f0b268e6288bf9a7b984624d7fe2031d - Patch
References () https://git.kernel.org/stable/c/202a3432d21ac060629a760fff3b0a39859da3ea - () https://git.kernel.org/stable/c/202a3432d21ac060629a760fff3b0a39859da3ea - Patch
References () https://git.kernel.org/stable/c/76d2e3890fb169168c73f2e4f8375c7cc24a765e - () https://git.kernel.org/stable/c/76d2e3890fb169168c73f2e4f8375c7cc24a765e - Patch
References () https://git.kernel.org/stable/c/92278ae36935a54e65fef9f8ea8efe7e80481ace - () https://git.kernel.org/stable/c/92278ae36935a54e65fef9f8ea8efe7e80481ace - Patch
References () https://git.kernel.org/stable/c/c32e3c71aaa1c1ba05da88605e2ddd493c58794f - () https://git.kernel.org/stable/c/c32e3c71aaa1c1ba05da88605e2ddd493c58794f - Patch
References () https://git.kernel.org/stable/c/f230d40147cc37eb3aef4d50e2e2c06ea73d9a77 - () https://git.kernel.org/stable/c/f230d40147cc37eb3aef4d50e2e2c06ea73d9a77 - Patch
References () https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html - () https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html - Third Party Advisory, Mailing List
References () https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html - () https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html - Third Party Advisory, Mailing List
CPE cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.17:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.17:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
First Time Linux
Debian
Debian debian Linux
Linux linux Kernel

03 Nov 2025, 18:16

Type Values Removed Values Added
References
  • () https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html -
  • () https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html -

08 Sep 2025, 07:15

Type Values Removed Values Added
References
  • () https://git.kernel.org/stable/c/0ff42a32784e0f2cb46a46da8e9f473538c13e1b -
  • () https://git.kernel.org/stable/c/181feb41f0b268e6288bf9a7b984624d7fe2031d -
  • () https://git.kernel.org/stable/c/c32e3c71aaa1c1ba05da88605e2ddd493c58794f -
  • () https://git.kernel.org/stable/c/f230d40147cc37eb3aef4d50e2e2c06ea73d9a77 -

05 Sep 2025, 18:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-09-05 18:15

Updated : 2026-01-08 16:09

NVD link : CVE-2025-39697

Mitre link : CVE-2025-39697

CVE.ORG link : CVE-2025-39697

JSON object : View

Products Affected

debian

  • debian_linux

linux

  • linux_kernel
CWE
CWE-362

Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')