Listen to this Post
How the CVE Works
The vulnerability is a logic error introduced during code refactoring in the Linux kernel’s Ceph filesystem module. The function `move_dirty_folio_in_page_array()` was created by moving existing code from `ceph_writepages_start()` to improve structure. This new function’s purpose is to handle page encryption via `fscrypt_encrypt_pagecache_blocks()` and return an error code if the operation fails.
The critical bug is in the error handling path. After an encryption failure, the code assigns a pointer to an error value (like -EIO), but then incorrectly nullifies this pointer before checking its value. The function returns PTR_ERR(NULL), which always evaluates to 0 (success). Consequently, the calling function, ceph_process_folio_batch(), does not detect the failure.
Because the error is silently ignored, the batch processing loop continues. The page that failed encryption is not marked as “redirty” for a retry and is instead left as a NULL entry within the kernel’s internal page array. When the kernel later attempts to process this NULL entry during writeback operations, it triggers a NULL pointer dereference. This illegal memory access causes an immediate kernel panic, crashing the entire system.
DailyCVE Form
Platform: Linux Kernel
Version: Affects versions with commit ce80b76dd327
Vulnerability : Kernel Crash
Severity: Critical
date: 2025-09-23
Prediction: 2025-10-07
What Undercode Say
Check if your kernel is vulnerable by examining the commit history for the fix. git log --oneline --grep="CVE-2025-39878" --grep="ceph" --grep="fscrypt_encrypt_pagecache_blocks" Example of searching for the patched function in kernel source. grep -r "move_dirty_folio_in_page_array" /usr/src/linux-headers-/ Basic command to check your current kernel version. uname -r
How Exploit
An exploit would require inducing an error in the `fscrypt_encrypt_pagecache_blocks()` function when the Ceph filesystem is writing dirty pages to disk. This could potentially be triggered by a local user with write permissions to an encrypted directory on a Ceph mount, causing a kernel panic and a Denial-of-Service (DoS). The crash is non-deterministic and depends on triggering a specific filesystem error state during page encryption.
Protection from this CVE
Update the Linux kernel to a version containing the official patch. The fix corrects the function’s return logic by calling `PTR_ERR()` on the error pointer before it is set to NULL, ensuring the actual error code is propagated to the caller. Apply patches from your Linux distribution as they become available.
Impact
The primary impact is a full system kernel panic and crash, leading to a denial of service (DoS). All services and processes on the affected machine are halted, requiring a reboot. Data corruption is possible if the crash occurs during active filesystem writeback operations.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
