BaseFortify

Publication date: 2025-10-01

Last updated on: 2025-12-12

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: nfs/localio: restore creds before releasing pageio data Otherwise if the nfsd filecache code releases the nfsd_file immediately, it can trigger the BUG_ON(cred == current->cred) in __put_cred() when it puts the nfsd_file->nf_file->f-cred.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2025-10-01

Last Modified

2025-12-12

Generated

2026-07-06

AI Q&A

2025-10-01

EPSS Evaluated

2026-07-05

NVD

CVE-2025-39912

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	From 6.12 (inc) to 6.12.48 (exc)
linux	linux_kernel	From 6.13 (inc) to 6.16.8 (exc)
linux	linux_kernel	6.17
linux	linux_kernel	6.17
linux	linux_kernel	6.17
linux	linux_kernel	6.17
linux	linux_kernel	6.17

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-NVD-CWE-noinfo

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves the nfsd filecache code where if the nfsd_file is released immediately without restoring credentials, it can trigger a BUG_ON error in the __put_cred() function related to credential handling. Specifically, the code fails to restore credentials before releasing pageio data, which causes an assertion failure when putting the file's credentials.

Impact Analysis

This vulnerability can cause the Linux kernel to hit a BUG_ON assertion failure, potentially leading to kernel crashes or instability when the nfsd filecache code mishandles credentials during file release operations.

Hi! I’m here to help you understand CVE-2025-39912. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70