Skip to main content

Linux Kernel CVE-2025-38357

HIGH
2025-07-25 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Information Disclosure Linux Red Hat Suse
7.8
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
7.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
3.3 LOW

Local unprivileged trigger via file close (AV:L/AC:L/PR:L/UI:N); impact is a one-time kernel WARN with no data or control compromise, so C:N/I:N and only A:L.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
SUSE
3.3 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Red Hat
6.1 MEDIUM
qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

2
Analysis Generated
Jul 30, 2026 - 08:28 vuln.today
CVE Published
Jul 25, 2025 - 13:15 nvd
HIGH 7.8

DescriptionNVD

In the Linux kernel, the following vulnerability has been resolved:

fuse: fix runtime warning on truncate_folio_batch_exceptionals()

The WARN_ON_ONCE is introduced on truncate_folio_batch_exceptionals() to capture whether the filesystem has removed all DAX entries or not.

And the fix has been applied on the filesystem xfs and ext4 by the commit 0e2f80afcfa6 ("fs/dax: ensure all pages are idle prior to filesystem unmount").

Apply the missed fix on filesystem fuse to fix the runtime warning:

[ 2.011450] ------------[ cut here ]------------ [ 2.011873] WARNING: CPU: 0 PID: 145 at mm/truncate.c:89 truncate_folio_batch_exceptionals+0x272/0x2b0 [ 2.012468] Modules linked in: [ 2.012718] CPU: 0 UID: 1000 PID: 145 Comm: weston Not tainted 6.16.0-rc2-WSL2-STABLE #2 PREEMPT(undef) [ 2.013292] RIP: 0010:truncate_folio_batch_exceptionals+0x272/0x2b0 [ 2.013704] Code: 48 63 d0 41 29 c5 48 8d 1c d5 00 00 00 00 4e 8d 6c 2a 01 49 c1 e5 03 eb 09 48 83 c3 08 49 39 dd 74 83 41 f6 44 1c 08 01 74 ef <0f> 0b 49 8b 34 1e 48 89 ef e8 10 a2 17 00 eb df 48 8b 7d 00 e8 35 [ 2.014845] RSP: 0018:ffffa47ec33f3b10 EFLAGS: 00010202 [ 2.015279] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000 [ 2.015884] RDX: 0000000000000000 RSI: ffffa47ec33f3ca0 RDI: ffff98aa44f3fa80 [ 2.016377] RBP: ffff98aa44f3fbf0 R08: ffffa47ec33f3ba8 R09: 0000000000000000 [ 2.016942] R10: 0000000000000001 R11: 0000000000000000 R12: ffffa47ec33f3ca0 [ 2.017437] R13: 0000000000000008 R14: ffffa47ec33f3ba8 R15: 0000000000000000 [ 2.017972] FS: 000079ce006afa40(0000) GS:ffff98aade441000(0000) knlGS:0000000000000000 [ 2.018510] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 2.018987] CR2: 000079ce03e74000 CR3: 000000010784f006 CR4: 0000000000372eb0 [ 2.019518] Call Trace: [ 2.019729] <TASK> [ 2.019901] truncate_inode_pages_range+0xd8/0x400 [ 2.020280] ? timerqueue_add+0x66/0xb0 [ 2.020574] ? get_nohz_timer_target+0x2a/0x140 [ 2.020904] ? timerqueue_add+0x66/0xb0 [ 2.021231] ? timerqueue_del+0x2e/0x50 [ 2.021646] ? __remove_hrtimer+0x39/0x90 [ 2.022017] ? srso_alias_untrain_ret+0x1/0x10 [ 2.022497] ? psi_group_change+0x136/0x350 [ 2.023046] ? _raw_spin_unlock+0xe/0x30 [ 2.023514] ? finish_task_switch.isra.0+0x8d/0x280 [ 2.024068] ? __schedule+0x532/0xbd0 [ 2.024551] fuse_evict_inode+0x29/0x190 [ 2.025131] evict+0x100/0x270 [ 2.025641] ? _atomic_dec_and_lock+0x39/0x50 [ 2.026316] ? __pfx_generic_delete_inode+0x10/0x10 [ 2.026843] __dentry_kill+0x71/0x180 [ 2.027335] dput+0xeb/0x1b0 [ 2.027725] __fput+0x136/0x2b0 [ 2.028054] __x64_sys_close+0x3d/0x80 [ 2.028469] do_syscall_64+0x6d/0x1b0 [ 2.028832] ? clear_bhb_loop+0x30/0x80 [ 2.029182] ? clear_bhb_loop+0x30/0x80 [ 2.029533] ? clear_bhb_loop+0x30/0x80 [ 2.029902] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 2.030423] RIP: 0033:0x79ce03d0d067 [ 2.030820] Code: b8 ff ff ff ff e9 3e ff ff ff 66 0f 1f 84 00 00 00 00 00 f3 0f 1e fa 64 8b 04 25 18 00 00 00 85 c0 75 10 b8 03 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 41 c3 48 83 ec 18 89 7c 24 0c e8 c3 a7 f8 ff [ 2.032354] RSP: 002b:00007ffef0498948 EFLAGS: 00000246 ORIG_RAX: 0000000000000003 [ 2.032939] RAX: ffffffffffffffda RBX: 00007ffef0498960 RCX: 000079ce03d0d067 [ 2.033612] RDX: 0000000000000003 RSI: 0000000000001000 RDI: 000000000000000d [ 2.034289] RBP: 00007ffef0498a30 R08: 000000000000000d R09: 0000000000000000 [ 2.034944] R10: 00007ffef0498978 R11: 0000000000000246 R12: 0000000000000001 [ 2.035610] R13: 00007ffef0498960 R14: 000079ce03e09ce0 R15: 0000000000000003 [ 2.036301] </TASK> [ 2.036532] ---[ end trace 0000000000000000 ]---

AnalysisAI

Kernel WARN triggered in the Linux kernel FUSE filesystem allows a local user mounting a DAX-backed FUSE filesystem to hit an unhandled warning in truncate_folio_batch_exceptionals() during inode eviction (fuse_evict_inode) on file close. The FUSE driver was missing the DAX-entry cleanup fix that xfs and ext4 already received (commit 0e2f80afcfa6), so DAX exceptional entries remained on the mapping at truncate time. Only pre-release kernels 6.16-rc1 through 6.16-rc3 are affected; no public exploit identified at time of analysis and EPSS probability is very low (0.15%).

Technical ContextAI

The issue lives in the FUSE (Filesystem in Userspace) subsystem of the Linux kernel when used with DAX (Direct Access), which maps persistent-memory/virtio-fs backing storage directly into the page cache using exceptional radix-tree/xarray entries rather than normal folios. A WARN_ON_ONCE at mm/truncate.c:89 in truncate_folio_batch_exceptionals() was added upstream to detect filesystems that fail to remove all DAX entries before teardown. xfs and ext4 were fixed by commit 0e2f80afcfa6 ("fs/dax: ensure all pages are idle prior to filesystem unmount"), but the equivalent cleanup was never applied to FUSE, so its inode eviction path left stale DAX exceptionals and tripped the warning. The CPE data scopes this strictly to linux:linux_kernel at 6.16 rc1/rc2/rc3, and the WARNING was reproduced under WSL2 (kernel 6.16.0-rc2-WSL2-STABLE) via a normal close() syscall by an unprivileged (UID 1000) process. No CWE was assigned; the root-cause class is best described as improper resource cleanup / missing state teardown rather than a memory-safety defect.

RemediationAI

Upstream fix available (commit); the corrective change is in the mainline/stable git tree - Vendor-released patch reference commits b48878aee8e7311411148c7a67c8f0b02f571d75 and befd9a71d859ea625eaa84dae1b243efb3df3eca, which port the DAX-entry cleanup (from commit 0e2f80afcfa6) into FUSE. Upgrade to the 6.16 release (or the rc that includes these commits) or later, or rebuild your kernel with the patch applied; distribution users running 6.16-rc kernels should move to the packaged 6.16 GA or a distro kernel that has backported the fix. If you cannot patch immediately, the practical compensating control is to avoid the affected configuration: do not enable DAX on FUSE/virtio-fs mounts (mount without the dax option), which eliminates the DAX exceptional entries that trigger the warning at the cost of losing direct-access performance for persistent-memory-backed shares. Because the impact is a benign one-time kernel log warning, the only real side effect of not patching is log noise, not instability.

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Not-Affected

Share

CVE-2025-38357 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy