CVE-2025-39723

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

netfs: Fix unbuffered write error handling

If all the subrequests in an unbuffered write stream fail, the subrequest

collector doesn't update the stream->transferred value and it retains its

initial LONG_MAX value. Unfortunately, if all active streams fail, then we

take the smallest value of { LONG_MAX, LONG_MAX, ... } as the value to set

in wreq->transferred - which is then returned from ->write_iter().

LONG_MAX was chosen as the initial value so that all the streams can be

quickly assessed by taking the smallest value of all stream->transferred -

but this only works if we've set any of them.

Fix this by adding a flag to indicate whether the value in

stream->transferred is valid and checking that when we integrate the

values. stream->transferred can then be initialised to zero.

This was found by running the generic/750 xfstest against cifs with

cache=none. It splices data to the target file. Once (if) it has

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References