{"api_version":"1","generated_at":"2026-10-22T03:10:03+00:00","cve":"CVE-2025-39868","urls":{"html":"https://cve.report/CVE-2025-39868","api":"https://cve.report/api/cve/CVE-2025-39868.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2025-39868","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2025-39868"},"summary":{"title":"erofs: fix runtime warning on truncate_folio_batch_exceptionals()","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nerofs: fix runtime warning on truncate_folio_batch_exceptionals()\n\nCommit 0e2f80afcfa6(\"fs/dax: ensure all pages are idle prior to\nfilesystem unmount\") introduced the WARN_ON_ONCE to capture whether\nthe filesystem has removed all DAX entries or not and applied the\nfix to xfs and ext4.\n\nApply the missed fix on erofs to fix the runtime warning:\n\n[  5.266254] ------------[ cut here ]------------\n[  5.266274] WARNING: CPU: 6 PID: 3109 at mm/truncate.c:89 truncate_folio_batch_exceptionals+0xff/0x260\n[  5.266294] Modules linked in:\n[  5.266999] CPU: 6 UID: 0 PID: 3109 Comm: umount Tainted: G S                  6.16.0+ #6 PREEMPT(voluntary)\n[  5.267012] Tainted: [S]=CPU_OUT_OF_SPEC\n[  5.267017] Hardware name: Dell Inc. OptiPlex 5000/05WXFV, BIOS 1.5.1 08/24/2022\n[  5.267024] RIP: 0010:truncate_folio_batch_exceptionals+0xff/0x260\n[  5.267076] Code: 00 00 41 39 df 7f 11 eb 78 83 c3 01 49 83 c4 08 41 39 df 74 6c 48 63 f3 48 83 fe 1f 0f 83 3c 01 00 00 43 f6 44 26 08 01 74 df <0f> 0b 4a 8b 34 22 4c 89 ef 48 89 55 90 e8 ff 54 1f 00 48 8b 55 90\n[  5.267083] RSP: 0018:ffffc900013f36c8 EFLAGS: 00010202\n[  5.267095] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000\n[  5.267101] RDX: ffffc900013f3790 RSI: 0000000000000000 RDI: ffff8882a1407898\n[  5.267108] RBP: ffffc900013f3740 R08: 0000000000000000 R09: 0000000000000000\n[  5.267113] R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000\n[  5.267119] R13: ffff8882a1407ab8 R14: ffffc900013f3888 R15: 0000000000000001\n[  5.267125] FS:  00007aaa8b437800(0000) GS:ffff88850025b000(0000) knlGS:0000000000000000\n[  5.267132] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n[  5.267138] CR2: 00007aaa8b3aac10 CR3: 000000024f764000 CR4: 0000000000f52ef0\n[  5.267144] PKRU: 55555554\n[  5.267150] Call Trace:\n[  5.267154]  <TASK>\n[  5.267181]  truncate_inode_pages_range+0x118/0x5e0\n[  5.267193]  ? save_trace+0x54/0x390\n[  5.267296]  truncate_inode_pages_final+0x43/0x60\n[  5.267309]  evict+0x2a4/0x2c0\n[  5.267339]  dispose_list+0x39/0x80\n[  5.267352]  evict_inodes+0x150/0x1b0\n[  5.267376]  generic_shutdown_super+0x41/0x180\n[  5.267390]  kill_block_super+0x1b/0x50\n[  5.267402]  erofs_kill_sb+0x81/0x90 [erofs]\n[  5.267436]  deactivate_locked_super+0x32/0xb0\n[  5.267450]  deactivate_super+0x46/0x60\n[  5.267460]  cleanup_mnt+0xc3/0x170\n[  5.267475]  __cleanup_mnt+0x12/0x20\n[  5.267485]  task_work_run+0x5d/0xb0\n[  5.267499]  exit_to_user_mode_loop+0x144/0x170\n[  5.267512]  do_syscall_64+0x2b9/0x7c0\n[  5.267523]  ? __lock_acquire+0x665/0x2ce0\n[  5.267535]  ? __lock_acquire+0x665/0x2ce0\n[  5.267560]  ? lock_acquire+0xcd/0x300\n[  5.267573]  ? find_held_lock+0x31/0x90\n[  5.267582]  ? mntput_no_expire+0x97/0x4e0\n[  5.267606]  ? mntput_no_expire+0xa1/0x4e0\n[  5.267625]  ? mntput+0x24/0x50\n[  5.267634]  ? path_put+0x1e/0x30\n[  5.267647]  ? do_faccessat+0x120/0x2f0\n[  5.267677]  ? do_syscall_64+0x1a2/0x7c0\n[  5.267686]  ? from_kgid_munged+0x17/0x30\n[  5.267703]  ? from_kuid_munged+0x13/0x30\n[  5.267711]  ? __do_sys_getuid+0x3d/0x50\n[  5.267724]  ? do_syscall_64+0x1a2/0x7c0\n[  5.267732]  ? irqentry_exit+0x77/0xb0\n[  5.267743]  ? clear_bhb_loop+0x30/0x80\n[  5.267752]  ? clear_bhb_loop+0x30/0x80\n[  5.267765]  entry_SYSCALL_64_after_hwframe+0x76/0x7e\n[  5.267772] RIP: 0033:0x7aaa8b32a9fb\n[  5.267781] Code: c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 f3 0f 1e fa 31 f6 e9 05 00 00 00 0f 1f 44 00 00 f3 0f 1e fa b8 a6 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 05 c3 0f 1f 40 00 48 8b 15 e9 83 0d 00 f7 d8\n[  5.267787] RSP: 002b:00007ffd7c4c9468 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6\n[  5.267796] RAX: 0000000000000000 RBX: 00005a61592a8b00 RCX: 00007aaa8b32a9fb\n[  5.267802] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 00005a61592b2080\n[  5.267806] RBP: 00007ffd7c4c9540 R08: 00007aaa8b403b20 R09: 0000000000000020\n[  5.267812] R10: 0000000000000001 R11: 0000000000000246 R12: 00005a61592a8c00\n[  5.267817] R13: 00000000\n---truncated---","state":"PUBLISHED","assigner":"Linux","published_at":"2025-09-23 06:15:45","updated_at":"2026-10-19 21:10:00"},"problem_types":["NVD-CWE-noinfo","CWE-noinfo Not enough information"],"metrics":[{"version":"3.1","source":"nvd@nist.gov","type":"Primary","score":"7.8","severity":"HIGH","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","data":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"}},{"version":"3.1","source":"ADP","type":"DECLARED","score":"7.8","severity":"HIGH","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","data":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"}},{"version":"3.1","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","score":"7.8","severity":"HIGH","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","data":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"}},{"version":"3.1","source":"CNA","type":"DECLARED","score":"7.8","severity":"HIGH","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","data":{"baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"}}],"references":[{"url":"https://git.kernel.org/stable/c/181993bb0d626cf88cc803f4356ce5c5abe86278","name":"https://git.kernel.org/stable/c/181993bb0d626cf88cc803f4356ce5c5abe86278","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/91c34cd6ca1bc67ccf2d104834956af56b5893de","name":"https://git.kernel.org/stable/c/91c34cd6ca1bc67ccf2d104834956af56b5893de","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-39868","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-39868","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected bde708f1a65d025c45575bfe1e7bf7bdf7e71e87 91c34cd6ca1bc67ccf2d104834956af56b5893de git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected bde708f1a65d025c45575bfe1e7bf7bdf7e71e87 181993bb0d626cf88cc803f4356ce5c5abe86278 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 6.15","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.15 semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.16.8 6.16.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.17 * original_commit_for_fix","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2025","cve_id":"39868","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"o","cpe4":"linux","cpe5":"linux_kernel","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2025","cve_id":"39868","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"o","cpe4":"linux","cpe5":"linux_kernel","cpe6":"6.17","cpe7":"rc1","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2025","cve_id":"39868","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"o","cpe4":"linux","cpe5":"linux_kernel","cpe6":"6.17","cpe7":"rc2","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2025","cve_id":"39868","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"o","cpe4":"linux","cpe5":"linux_kernel","cpe6":"6.17","cpe7":"rc3","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2025","cve_id":"39868","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"o","cpe4":"linux","cpe5":"linux_kernel","cpe6":"6.17","cpe7":"rc4","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2025","cve_id":"39868","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"o","cpe4":"linux","cpe5":"linux_kernel","cpe6":"6.17","cpe7":"rc5","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":{"cve_year":"2025","cve_id":"39868","cve":"CVE-2025-39868","epss":"0.001460000","percentile":"0.034780000","score_date":"2026-10-19","updated_at":"2026-10-20 00:13:48"},"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"metrics":[{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"}},{"other":{"content":{"id":"CVE-2025-39868","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"role":"CISA Coordinator","timestamp":"2026-01-14T19:24:11.670822Z","version":"2.0.3"},"type":"ssvc"}}],"problemTypes":[{"descriptions":[{"description":"CWE-noinfo Not enough information","lang":"en","type":"CWE"}]}],"providerMetadata":{"dateUpdated":"2026-01-14T19:33:11.858Z","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP"},"title":"CISA ADP Vulnrichment"}],"cna":{"affected":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["fs/erofs/super.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"91c34cd6ca1bc67ccf2d104834956af56b5893de","status":"affected","version":"bde708f1a65d025c45575bfe1e7bf7bdf7e71e87","versionType":"git"},{"lessThan":"181993bb0d626cf88cc803f4356ce5c5abe86278","status":"affected","version":"bde708f1a65d025c45575bfe1e7bf7bdf7e71e87","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["fs/erofs/super.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.15"},{"lessThan":"6.15","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.16.*","status":"unaffected","version":"6.16.8","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"6.17","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.16.8","versionStartIncluding":"6.15","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.17","versionStartIncluding":"6.15","vulnerable":true}],"negate":false,"operator":"OR"}]}],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nerofs: fix runtime warning on truncate_folio_batch_exceptionals()\n\nCommit 0e2f80afcfa6(\"fs/dax: ensure all pages are idle prior to\nfilesystem unmount\") introduced the WARN_ON_ONCE to capture whether\nthe filesystem has removed all DAX entries or not and applied the\nfix to xfs and ext4.\n\nApply the missed fix on erofs to fix the runtime warning:\n\n[  5.266254] ------------[ cut here ]------------\n[  5.266274] WARNING: CPU: 6 PID: 3109 at mm/truncate.c:89 truncate_folio_batch_exceptionals+0xff/0x260\n[  5.266294] Modules linked in:\n[  5.266999] CPU: 6 UID: 0 PID: 3109 Comm: umount Tainted: G S                  6.16.0+ #6 PREEMPT(voluntary)\n[  5.267012] Tainted: [S]=CPU_OUT_OF_SPEC\n[  5.267017] Hardware name: Dell Inc. OptiPlex 5000/05WXFV, BIOS 1.5.1 08/24/2022\n[  5.267024] RIP: 0010:truncate_folio_batch_exceptionals+0xff/0x260\n[  5.267076] Code: 00 00 41 39 df 7f 11 eb 78 83 c3 01 49 83 c4 08 41 39 df 74 6c 48 63 f3 48 83 fe 1f 0f 83 3c 01 00 00 43 f6 44 26 08 01 74 df <0f> 0b 4a 8b 34 22 4c 89 ef 48 89 55 90 e8 ff 54 1f 00 48 8b 55 90\n[  5.267083] RSP: 0018:ffffc900013f36c8 EFLAGS: 00010202\n[  5.267095] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000\n[  5.267101] RDX: ffffc900013f3790 RSI: 0000000000000000 RDI: ffff8882a1407898\n[  5.267108] RBP: ffffc900013f3740 R08: 0000000000000000 R09: 0000000000000000\n[  5.267113] R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000\n[  5.267119] R13: ffff8882a1407ab8 R14: ffffc900013f3888 R15: 0000000000000001\n[  5.267125] FS:  00007aaa8b437800(0000) GS:ffff88850025b000(0000) knlGS:0000000000000000\n[  5.267132] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n[  5.267138] CR2: 00007aaa8b3aac10 CR3: 000000024f764000 CR4: 0000000000f52ef0\n[  5.267144] PKRU: 55555554\n[  5.267150] Call Trace:\n[  5.267154]  <TASK>\n[  5.267181]  truncate_inode_pages_range+0x118/0x5e0\n[  5.267193]  ? save_trace+0x54/0x390\n[  5.267296]  truncate_inode_pages_final+0x43/0x60\n[  5.267309]  evict+0x2a4/0x2c0\n[  5.267339]  dispose_list+0x39/0x80\n[  5.267352]  evict_inodes+0x150/0x1b0\n[  5.267376]  generic_shutdown_super+0x41/0x180\n[  5.267390]  kill_block_super+0x1b/0x50\n[  5.267402]  erofs_kill_sb+0x81/0x90 [erofs]\n[  5.267436]  deactivate_locked_super+0x32/0xb0\n[  5.267450]  deactivate_super+0x46/0x60\n[  5.267460]  cleanup_mnt+0xc3/0x170\n[  5.267475]  __cleanup_mnt+0x12/0x20\n[  5.267485]  task_work_run+0x5d/0xb0\n[  5.267499]  exit_to_user_mode_loop+0x144/0x170\n[  5.267512]  do_syscall_64+0x2b9/0x7c0\n[  5.267523]  ? __lock_acquire+0x665/0x2ce0\n[  5.267535]  ? __lock_acquire+0x665/0x2ce0\n[  5.267560]  ? lock_acquire+0xcd/0x300\n[  5.267573]  ? find_held_lock+0x31/0x90\n[  5.267582]  ? mntput_no_expire+0x97/0x4e0\n[  5.267606]  ? mntput_no_expire+0xa1/0x4e0\n[  5.267625]  ? mntput+0x24/0x50\n[  5.267634]  ? path_put+0x1e/0x30\n[  5.267647]  ? do_faccessat+0x120/0x2f0\n[  5.267677]  ? do_syscall_64+0x1a2/0x7c0\n[  5.267686]  ? from_kgid_munged+0x17/0x30\n[  5.267703]  ? from_kuid_munged+0x13/0x30\n[  5.267711]  ? __do_sys_getuid+0x3d/0x50\n[  5.267724]  ? do_syscall_64+0x1a2/0x7c0\n[  5.267732]  ? irqentry_exit+0x77/0xb0\n[  5.267743]  ? clear_bhb_loop+0x30/0x80\n[  5.267752]  ? clear_bhb_loop+0x30/0x80\n[  5.267765]  entry_SYSCALL_64_after_hwframe+0x76/0x7e\n[  5.267772] RIP: 0033:0x7aaa8b32a9fb\n[  5.267781] Code: c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 f3 0f 1e fa 31 f6 e9 05 00 00 00 0f 1f 44 00 00 f3 0f 1e fa b8 a6 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 05 c3 0f 1f 40 00 48 8b 15 e9 83 0d 00 f7 d8\n[  5.267787] RSP: 002b:00007ffd7c4c9468 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6\n[  5.267796] RAX: 0000000000000000 RBX: 00005a61592a8b00 RCX: 00007aaa8b32a9fb\n[  5.267802] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 00005a61592b2080\n[  5.267806] RBP: 00007ffd7c4c9540 R08: 00007aaa8b403b20 R09: 0000000000000020\n[  5.267812] R10: 0000000000000001 R11: 0000000000000246 R12: 00005a61592a8c00\n[  5.267817] R13: 00000000\n---truncated---"}],"metrics":[{"cvssV3_1":{"baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"scenarios":[{"lang":"en","value":"AV:L - Triggering requires local access to an already-mounted `dax=always` erofs filesystem — reading or mmap'ing a file to populate DAX entries, then driving inode eviction via the shrinker or unmount. No remote or adjacent network peer can reach `truncate_folio_batch_exceptionals()` on an erofs mapping.\nAC:L - Within an erofs+DAX deployment the trigger is fully deterministic and entirely attacker-driven — read one regular flat/chunked file, then force eviction; there is no race to win and no memory layout dependency, as evidenced by the reporter hitting it on stock hardware five seconds into boot. Holding a long-term GUP pin across eviction (RDMA `ib_umem`, vfio, io_uring registered buffers) is likewise fully under attacker control.\nPR:L - The attacker needs only an unprivileged local account with read access to the DAX-mounted erofs tree — the mount itself is part of the deployment (container image over virtio-pmem, Android/ChromeOS system partition), not something the attacker must create. Populating DAX entries via read/mmap and forcing inode reclaim through memory pressure require no capabilities.\nUI:N - The attacker performs every step itself — open, read/mmap, optional GUP pin, then memory pressure to drive the inode shrinker into `evict()`. No victim action is needed beyond the pre-existing mount, which is normal system operation rather than an attacker-induced interaction.\nS:U - The corruption and the crash are confined to the kernel's page-cache and FS-DAX state within the same security authority; no hypervisor, IOMMU, or sandbox boundary is crossed by the vulnerability itself.\nC:H - Because erofs never waits for DAX pages to go idle, `dax_delete_mapping_entry()` drops the page-cache entry while a page may still be DMA-busy, and FS DAX permanently loses track of it — a pinned page can therefore keep servicing device/RDMA reads of those pmem blocks after the mount is gone and the region has been recycled to another tenant's image, disclosing data from a different security domain.\nI:H - `dax_folio_put()` clears `folio->mapping` and tears a compound DAX folio down to order-0 pages (`ClearPageHead`/`clear_compound_head`) underneath a live pin — the adjacent `WARN_ON_ONCE(folio_ref_count())` documents the violated invariant — corrupting folio and refcount state on the subsequent unpin; upstream states outright that the missing break allows a busy block to be reallocated to a new file, \"leading to corruption.\"\nA:H - Eviction of any DAX erofs inode hits `WARN_ON_ONCE(1)` at `mm/truncate.c:89`, which on the hardened, cloud, and Android configurations that set `panic_on_warn` is an immediate kernel panic and full denial of service; the same path also dismantles folio state under outstanding pins, producing later crashes on unpin."}]}],"providerMetadata":{"dateUpdated":"2026-08-05T12:05:46.658Z","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux"},"references":[{"url":"https://git.kernel.org/stable/c/91c34cd6ca1bc67ccf2d104834956af56b5893de"},{"url":"https://git.kernel.org/stable/c/181993bb0d626cf88cc803f4356ce5c5abe86278"}],"title":"erofs: fix runtime warning on truncate_folio_batch_exceptionals()","x_generator":{"engine":"bippy-1.2.0"}}},"cveMetadata":{"assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","assignerShortName":"Linux","cveId":"CVE-2025-39868","datePublished":"2025-09-23T06:00:43.308Z","dateReserved":"2025-04-16T07:20:57.143Z","dateUpdated":"2026-08-05T12:05:46.658Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2025-09-23 06:15:45","lastModifiedDate":"2026-10-19 21:10:00","problem_types":["NVD-CWE-noinfo","CWE-noinfo Not enough information"],"metrics":{"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-01-14T19:24:11.670822Z","id":"CVE-2025-39868","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.15","versionEndExcluding":"6.16.8","matchCriteriaId":"4CDBA6F5-ADD5-4E49-89EE-9FA2364F2685"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:6.17:rc1:*:*:*:*:*:*","matchCriteriaId":"327D22EF-390B-454C-BD31-2ED23C998A1C"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:6.17:rc2:*:*:*:*:*:*","matchCriteriaId":"C730CD9A-D969-4A8E-9522-162AAF7C0EE9"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:6.17:rc3:*:*:*:*:*:*","matchCriteriaId":"39982C4B-716E-4B2F-8196-FA301F47807D"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:6.17:rc4:*:*:*:*:*:*","matchCriteriaId":"340BEEA9-D70D-4290-B502-FBB1032353B1"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:6.17:rc5:*:*:*:*:*:*","matchCriteriaId":"47E4C5C0-079F-4838-971B-8C503D48FCC2"}]}]}]},"legacy_mitre":{"record":{"CveYear":"2025","CveId":"39868","Ordinal":"1","Title":"erofs: fix runtime warning on truncate_folio_batch_exceptionals(","CVE":"CVE-2025-39868","Year":"2025"},"notes":[{"CveYear":"2025","CveId":"39868","Ordinal":"1","NoteData":"In the Linux kernel, the following vulnerability has been resolved:\n\nerofs: fix runtime warning on truncate_folio_batch_exceptionals()\n\nCommit 0e2f80afcfa6(\"fs/dax: ensure all pages are idle prior to\nfilesystem unmount\") introduced the WARN_ON_ONCE to capture whether\nthe filesystem has removed all DAX entries or not and applied the\nfix to xfs and ext4.\n\nApply the missed fix on erofs to fix the runtime warning:\n\n[  5.266254] ------------[ cut here ]------------\n[  5.266274] WARNING: CPU: 6 PID: 3109 at mm/truncate.c:89 truncate_folio_batch_exceptionals+0xff/0x260\n[  5.266294] Modules linked in:\n[  5.266999] CPU: 6 UID: 0 PID: 3109 Comm: umount Tainted: G S                  6.16.0+ #6 PREEMPT(voluntary)\n[  5.267012] Tainted: [S]=CPU_OUT_OF_SPEC\n[  5.267017] Hardware name: Dell Inc. OptiPlex 5000/05WXFV, BIOS 1.5.1 08/24/2022\n[  5.267024] RIP: 0010:truncate_folio_batch_exceptionals+0xff/0x260\n[  5.267076] Code: 00 00 41 39 df 7f 11 eb 78 83 c3 01 49 83 c4 08 41 39 df 74 6c 48 63 f3 48 83 fe 1f 0f 83 3c 01 00 00 43 f6 44 26 08 01 74 df <0f> 0b 4a 8b 34 22 4c 89 ef 48 89 55 90 e8 ff 54 1f 00 48 8b 55 90\n[  5.267083] RSP: 0018:ffffc900013f36c8 EFLAGS: 00010202\n[  5.267095] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000\n[  5.267101] RDX: ffffc900013f3790 RSI: 0000000000000000 RDI: ffff8882a1407898\n[  5.267108] RBP: ffffc900013f3740 R08: 0000000000000000 R09: 0000000000000000\n[  5.267113] R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000\n[  5.267119] R13: ffff8882a1407ab8 R14: ffffc900013f3888 R15: 0000000000000001\n[  5.267125] FS:  00007aaa8b437800(0000) GS:ffff88850025b000(0000) knlGS:0000000000000000\n[  5.267132] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n[  5.267138] CR2: 00007aaa8b3aac10 CR3: 000000024f764000 CR4: 0000000000f52ef0\n[  5.267144] PKRU: 55555554\n[  5.267150] Call Trace:\n[  5.267154]  <TASK>\n[  5.267181]  truncate_inode_pages_range+0x118/0x5e0\n[  5.267193]  ? save_trace+0x54/0x390\n[  5.267296]  truncate_inode_pages_final+0x43/0x60\n[  5.267309]  evict+0x2a4/0x2c0\n[  5.267339]  dispose_list+0x39/0x80\n[  5.267352]  evict_inodes+0x150/0x1b0\n[  5.267376]  generic_shutdown_super+0x41/0x180\n[  5.267390]  kill_block_super+0x1b/0x50\n[  5.267402]  erofs_kill_sb+0x81/0x90 [erofs]\n[  5.267436]  deactivate_locked_super+0x32/0xb0\n[  5.267450]  deactivate_super+0x46/0x60\n[  5.267460]  cleanup_mnt+0xc3/0x170\n[  5.267475]  __cleanup_mnt+0x12/0x20\n[  5.267485]  task_work_run+0x5d/0xb0\n[  5.267499]  exit_to_user_mode_loop+0x144/0x170\n[  5.267512]  do_syscall_64+0x2b9/0x7c0\n[  5.267523]  ? __lock_acquire+0x665/0x2ce0\n[  5.267535]  ? __lock_acquire+0x665/0x2ce0\n[  5.267560]  ? lock_acquire+0xcd/0x300\n[  5.267573]  ? find_held_lock+0x31/0x90\n[  5.267582]  ? mntput_no_expire+0x97/0x4e0\n[  5.267606]  ? mntput_no_expire+0xa1/0x4e0\n[  5.267625]  ? mntput+0x24/0x50\n[  5.267634]  ? path_put+0x1e/0x30\n[  5.267647]  ? do_faccessat+0x120/0x2f0\n[  5.267677]  ? do_syscall_64+0x1a2/0x7c0\n[  5.267686]  ? from_kgid_munged+0x17/0x30\n[  5.267703]  ? from_kuid_munged+0x13/0x30\n[  5.267711]  ? __do_sys_getuid+0x3d/0x50\n[  5.267724]  ? do_syscall_64+0x1a2/0x7c0\n[  5.267732]  ? irqentry_exit+0x77/0xb0\n[  5.267743]  ? clear_bhb_loop+0x30/0x80\n[  5.267752]  ? clear_bhb_loop+0x30/0x80\n[  5.267765]  entry_SYSCALL_64_after_hwframe+0x76/0x7e\n[  5.267772] RIP: 0033:0x7aaa8b32a9fb\n[  5.267781] Code: c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 f3 0f 1e fa 31 f6 e9 05 00 00 00 0f 1f 44 00 00 f3 0f 1e fa b8 a6 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 05 c3 0f 1f 40 00 48 8b 15 e9 83 0d 00 f7 d8\n[  5.267787] RSP: 002b:00007ffd7c4c9468 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6\n[  5.267796] RAX: 0000000000000000 RBX: 00005a61592a8b00 RCX: 00007aaa8b32a9fb\n[  5.267802] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 00005a61592b2080\n[  5.267806] RBP: 00007ffd7c4c9540 R08: 00007aaa8b403b20 R09: 0000000000000020\n[  5.267812] R10: 0000000000000001 R11: 0000000000000246 R12: 00005a61592a8c00\n[  5.267817] R13: 00000000\n---truncated---","Type":"Description","Title":"erofs: fix runtime warning on truncate_folio_batch_exceptionals("}]}}}