Riskcovery

CVE-2025-39912

nfs/localio: restore creds before releasing pageio data

State
Published
Severity
5.5 Medium
Published
Oct 1, 2025
Updated
May 11, 2026
Reserved
Apr 16, 2025

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

nfs/localio: restore creds before releasing pageio data

Otherwise if the nfsd filecache code releases the nfsd_file immediately, it can trigger the BUG_ON(cred == current->cred) in __put_cred() when it puts the nfsd_file->nf_file->f-cred.

Scores

CVSSScoreVectorSource
3.15.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HCISA-ADP

Weaknesses

The record names no weakness.

Affected Products

ProductVersions
LinuxLinux
  • b9f5dd57f4a52990963eeb1f1b58d00f717ece69 to before 57c1bb02b4fc8eec6eb01736e7fad26dffacf18cAffected
  • b9f5dd57f4a52990963eeb1f1b58d00f717ece69 to before c250be1d75bf80dc5ab46f0b434b746c1868a1eaAffected
  • b9f5dd57f4a52990963eeb1f1b58d00f717ece69 to before 992203a1fba51b025c60ec0c8b0d9223343dea95Affected
LinuxLinux
  • 6.12Affected
  • before 6.12Not affected
  • 6.12.48 through 6.12.*Not affected
  • 6.16.8 through 6.16.*Not affected
  • 6.17 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.