CVE-2025-39879

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

ceph: always call ceph_shift_unused_folios_left()

The function ceph_process_folio_batch() sets folio_batch entries to

NULL, which is an illegal state. Before folio_batch_release() crashes

due to this API violation, the function ceph_shift_unused_folios_left()

is supposed to remove those NULLs from the array.

However, since commit ce80b76dd327 ("ceph: introduce

ceph_process_folio_batch() method"), this shifting doesn't happen

anymore because the "for" loop got moved to ceph_process_folio_batch(),

and now the `i` variable that remains in ceph_writepages_start()

doesn't get incremented anymore, making the shifting effectively

unreachable much of the time.

Later, commit 1551ec61dc55 ("ceph: introduce ceph_submit_write()

method") added more preconditions for doing the shift, replacing the

`i` check (with something that is still just as broken):

- if ceph_process_folio_batch() fails, shifting never happens

- if ceph_m

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References