7.8 High

CVE-2025-39697 In the Linux kernel, the following vulnerability has been resolved: NFS: Fix a race when updating an existing write…

Description

In the Linux kernel, the following vulnerability has been resolved: NFS: Fix a race when updating an existing write After nfs_lock_and_join_requests() tests for whether the request is still attached to the mapping, nothing prevents a call to nfs_inode_remove_request() from succeeding until we actually lock the page group. The reason is that whoever called nfs_inode_remove_request() doesn't necessarily have a lock on the page group head. So in order to avoid races, let's take the page group lock earlier in nfs_lock_and_join_requests(), and hold it across the removal of the request in nfs_inode_remove_request().

Affected products and versions

Product	Affected versions	Fixed in
Linux 6.17	earliest → < 6.17	6.17
Linux 6.16	earliest → < 6.16.4	6.16.4
Linux 6.12	earliest → < 6.12.44	6.12.44
Linux 6.6	earliest → < 6.6.104	6.6.104
Linux 6.1	earliest → < 6.1.150	6.1.150
Linux 5.15	earliest → < 5.15.191	5.15.191
Linux 5.10	earliest → < 5.10.242	5.10.242
Linux	4.14	No fix stated
SIMATIC CN 4100 5.0	earliest → < 5.0	5.0

Show the 3 other branches

Product	Affected versions	Fixed in
SIMATIC S7-1500 CPU 1518-4 PN/DP MFP 3.1	3.1.5 → latest	No fix stated
SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP 3.1	3.1.5 → latest	No fix stated
SIPLUS S7-1500 CPU 1518-4 PN/DP MFP 3.1	3.1.5 → latest	No fix stated