{"id":"CVE-2025-39691","revision":null,"records":[{"revision":"a20ac4514d8a48fcbb379291cf66bfb6","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2025-39691","aliases":[],"title":"fs/buffer: fix use-after-free when call bh_read() helper","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nfs/buffer: fix use-after-free when call bh_read() helper\n\nThere's issue as follows:\nBUG: KASAN: stack-out-of-bounds in end_buffer_read_sync+0xe3/0x110\nRead of size 8 at addr ffffc9000168f7f8 by task swapper/3/0\nCPU: 3 UID: 0 PID: 0 Comm: swapper/3 Not tainted 6.16.0-862.14.0.6.x86_64\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996)\nCall Trace:\n \n dump_stack_lvl+0x55/0x70\n print_address_description.constprop.0+0x2c/0x390\n print_report+0xb4/0x270\n kasan_report+0xb8/0xf0\n end_buffer_read_sync+0xe3/0x110\n end_bio_bh_io_sync+0x56/0x80\n blk_update_request+0x30a/0x720\n scsi_end_request+0x51/0x2b0\n scsi_io_completion+0xe3/0x480\n ? scsi_device_unbusy+0x11e/0x160\n blk_complete_reqs+0x7b/0x90\n handle_softirqs+0xef/0x370\n irq_exit_rcu+0xa5/0xd0\n sysvec_apic_timer_interrupt+0x6e/0x90\n \n\n Above issue happens when do ntfs3 filesystem mount, issue may happens\n as follows:\n mount IRQ\nntfs_fill_super\n read_cache_page\n do_read_cache_folio\n filemap_read_folio\n mpage_read_folio\n\t do_mpage_readpage\n\t ntfs_get_block_vbo\n\t bh_read\n\t submit_bh\n\t wait_on_buffer(bh);\n\t blk_complete_reqs\n\t\t\t\t scsi_io_completion\n\t\t\t\t scsi_end_request\n\t\t\t\t blk_update_request\n\t\t\t\t end_bio_bh_io_sync\n\t\t\t\t\t end_buffer_read_sync\n\t\t\t\t\t __end_buffer_read_notouch\n\t\t\t\t\t unlock_buffer\n\n wait_on_buffer(bh);--> return will return to caller\n\n\t\t\t\t\t put_bh\n\t\t\t\t\t --> trigger stack-out-of-bounds\nIn the mpage_read_folio() function, the stack variable 'map_bh' is\npassed to ntfs_get_block_vbo(). Once unlock_buffer() unlocks and\nwait_on_buffer() returns to continue processing, the stack variable\nis likely to be reclaimed. Consequently, during the end_buffer_read_sync()\nprocess, calling put_bh() may result in stack overrun.\n\nIf the bh is not allocated on the stack, it belongs to a folio. Freeing\na buffer head which belongs to a folio is done by drop_buffers() which\nwill fail to free buffers which are still locked. So it is safe to call\nput_bh() before __end_buffer_read_notouch().","state":0,"publishedAt":"2025-09-05T17:20:57.247+00:00","modifiedAt":"2026-10-15T22:02:30.511+00:00","affected":[{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n \"product\": \"Linux\",\n \"vendor\": \"Linux\",\n \"defaultStatus\": \"unaffected\",\n \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n \"programFiles\": [\n \"fs/buffer.c\"\n ],\n \"versions\": [\n {\n \"version\": \"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2\",\n \"lessThan\": \"70a09115da586bf662c3bae9c0c4a1b99251fad9\",\n \"status\": \"affected\",\n \"versionType\": \"git\"\n },\n {\n \"version\": \"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2\",\n \"lessThan\": \"3169edb8945c295cf89120fc6b2c35cfe3ad4c9e\",\n \"status\": \"affected\",\n \"versionType\": \"git\"\n },\n {\n \"version\": \"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2\",\n \"lessThan\": \"03b40bf5d0389ca23ae6857ee25789f0e0b47ce8\",\n \"status\": \"affected\",\n \"versionType\": \"git\"\n },\n {\n \"version\": \"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2\",\n \"lessThan\": \"c58c6b532b7b69537cfd9ef701c7e37cdcf79dc4\",\n \"status\": \"affected\",\n \"versionType\": \"git\"\n },\n {\n \"version\": \"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2\",\n \"lessThan\": \"c5aa6ba1127307ab5dc3773eaf40d73a3423841f\",\n \"status\": \"affected\",\n \"versionType\": \"git\"\n },\n {\n \"version\": \"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2\",\n \"lessThan\": \"042cf48ecf67f72c8b3846c7fac678f472712ff3\",\n \"status\": \"affected\",\n \"versionType\": \"git\"\n },\n {\n \"version\": \"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2\",\n \"lessThan\": \"90b5193edb323fefbee0e4e5bc39ed89dcc37719\",\n \"status\": \"affected\",\n \"versionType\": \"git\"\n },\n {\n \"version\": \"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2\",\n \"lessThan\": \"7375f22495e7cd1c5b3b5af9dcc4f6dffe34ce49\",\n \"status\": \"affected\",\n \"versionType\": \"git\"\n }\n ]\n }"},{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n \"product\": \"Linux\",\n \"vendor\": \"Linux\",\n \"defaultStatus\": \"affected\",\n \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n \"programFiles\": [\n \"fs/buffer.c\"\n ],\n \"versions\": [\n {\n \"version\": \"2.6.12\",\n \"status\": \"affected\"\n },\n {\n \"version\": \"0\",\n \"lessThan\": \"2.6.12\",\n \"status\": \"unaffected\",\n \"versionType\": \"semver\"\n },\n {\n \"version\": \"5.4.297\",\n \"lessThanOrEqual\": \"5.4.*\",\n \"status\": \"unaffected\",\n \"versionType\": \"semver\"\n },\n {\n \"version\": \"5.10.241\",\n \"lessThanOrEqual\": \"5.10.*\",\n \"status\": \"unaffected\",\n \"versionType\": \"semver\"\n },\n {\n \"version\": \"5.15.190\",\n \"lessThanOrEqual\": \"5.15.*\",\n \"status\": \"unaffected\",\n \"versionType\": \"semver\"\n },\n {\n \"version\": \"6.1.149\",\n \"lessThanOrEqual\": \"6.1.*\",\n \"status\": \"unaffected\",\n \"versionType\": \"semver\"\n },\n {\n \"version\": \"6.6.103\",\n \"lessThanOrEqual\": \"6.6.*\",\n \"status\": \"unaffected\",\n \"versionType\": \"semver\"\n },\n {\n \"version\": \"6.12.44\",\n \"lessThanOrEqual\": \"6.12.*\",\n \"status\": \"unaffected\",\n \"versionType\": \"semver\"\n },\n {\n \"version\": \"6.16.4\",\n \"lessThanOrEqual\": \"6.16.*\",\n \"status\": \"unaffected\",\n \"versionType\": \"semver\"\n },\n {\n \"version\": \"6.17\",\n \"lessThanOrEqual\": \"*\",\n \"status\": \"unaffected\",\n \"versionType\": \"original_commit_for_fix\"\n }\n ]\n }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","score":7.8,"severity":"HIGH"}],"references":["https://git.kernel.org/stable/c/70a09115da586bf662c3bae9c0c4a1b99251fad9","https://git.kernel.org/stable/c/3169edb8945c295cf89120fc6b2c35cfe3ad4c9e","https://git.kernel.org/stable/c/03b40bf5d0389ca23ae6857ee25789f0e0b47ce8","https://git.kernel.org/stable/c/c58c6b532b7b69537cfd9ef701c7e37cdcf79dc4","https://git.kernel.org/stable/c/c5aa6ba1127307ab5dc3773eaf40d73a3423841f","https://git.kernel.org/stable/c/042cf48ecf67f72c8b3846c7fac678f472712ff3","https://git.kernel.org/stable/c/90b5193edb323fefbee0e4e5bc39ed89dcc37719","https://git.kernel.org/stable/c/7375f22495e7cd1c5b3b5af9dcc4f6dffe34ce49"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2025-39691","license":"CVE Program Terms of Use","key":"cve-program:CVE-2025-39691","identifiers":["CVE-2025-39691"]},"retained":false,"historicalAffected":[]}],"coverage":[{"source":"cisa-kev:global","scope":"Complete CISA KEV catalog; all vendors. Missing entries do not establish absence of exploitation.","generation":"2026-11-09T12:02:21.9910047+00:00","complete":true,"records":1769,"lastAttemptAt":"2026-11-09T12:02:21.9910047+00:00","lastSuccessAt":"2026-11-09T12:02:22.1773794+00:00","error":null,"lastVerifiedAt":"2026-11-09T12:02:22.1773831+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"cve-program","scope":"Official CVE Program baseline and cumulative hourly delta; all vendors, published and rejected records","generation":"cve-24e6fde7b744113daefb8f6135035fb8a5c69c9617c9c0d40574a0376532ffd3-bc5670b92e6417137e6d98178f734a585c0efdac3c24cdab996a156ba398735b","complete":true,"records":421397,"lastAttemptAt":"2026-11-09T12:02:16.4943065+00:00","lastSuccessAt":"2026-11-09T12:02:16.4102763+00:00","error":null,"lastVerifiedAt":"2026-11-09T12:02:16.4943065+00:00","snapshotPublishedAt":"2026-11-09T11:21:04+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"euvd","scope":"Rolling EUVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global EUVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-469e0902b40147e98a6498cf72d41be8","complete":true,"records":13655,"lastAttemptAt":"2026-11-09T12:14:17.3321495+00:00","lastSuccessAt":"2026-11-09T12:14:17.327+00:00","error":null,"lastVerifiedAt":"2026-11-09T12:14:17.327+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13707,"expectedIdentifiers":13707,"failedIdentifiers":0},{"source":"first-epss:nuget","scope":"FIRST EPSS for explicit CVE aliases in the collected public NuGet archive. Not a global EPSS backfill.","generation":"2026-11-09T12:02:21.9910047+00:00","complete":true,"records":1096,"lastAttemptAt":"2026-11-09T12:02:21.9910047+00:00","lastSuccessAt":"2026-11-09T12:02:22.1781502+00:00","error":null,"lastVerifiedAt":"2026-11-09T12:02:22.1781508+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"nvd","scope":"Rolling NVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global NVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-44231a3c29e84c64b271bb4e9b8f3678","complete":true,"records":13667,"lastAttemptAt":"2026-11-09T12:02:23.2886601+00:00","lastSuccessAt":"2026-11-09T12:02:23.284+00:00","error":null,"lastVerifiedAt":"2026-11-09T12:02:23.284+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13707,"expectedIdentifiers":13707,"failedIdentifiers":0},{"source":"osv:Go","scope":"Complete OSV Go ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"go-980593e6977a6d1b4fb1eed5a1ffe88a468736f89f0a06f710924ad59132c023","complete":true,"records":9914,"lastAttemptAt":"2026-11-09T12:02:17.2599038+00:00","lastSuccessAt":"2026-11-08T11:07:07.068788+00:00","error":null,"lastVerifiedAt":"2026-11-09T12:02:17.2599038+00:00","snapshotPublishedAt":"2026-11-08T11:02:46+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:NuGet","scope":"Complete OSV NuGet ecosystem archive, including GitHub Advisory Database records; NuGet version matching only","generation":"nuget-fde804134ecdda0ddd5ff5c26ee1fff5a6fa659311f7ef2e51c6ad54964db0e2","complete":true,"records":1971,"lastAttemptAt":"2026-11-09T12:02:16.7165115+00:00","lastSuccessAt":"2026-11-06T19:03:17.0399903+00:00","error":null,"lastVerifiedAt":"2026-11-09T12:02:16.7165115+00:00","snapshotPublishedAt":"2026-11-06T18:17:57+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:crates.io","scope":"Complete OSV crates.io ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"crates.io-c905fa1bd26c7b261e77cc7202a86dc766ff31c2b096b501f3bf44f561e34970","complete":true,"records":3063,"lastAttemptAt":"2026-11-09T12:02:21.9559708+00:00","lastSuccessAt":"2026-11-09T12:02:21.7931207+00:00","error":null,"lastVerifiedAt":"2026-11-09T12:02:21.9559708+00:00","snapshotPublishedAt":"2026-11-09T11:18:00+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:npm","scope":"Complete OSV npm ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"npm-e6e6ac3eaece246ff08884368fe1dc99d4d393571e77c126c8f4d38d66697688","complete":true,"records":231297,"lastAttemptAt":"2026-11-09T12:02:17.0901763+00:00","lastSuccessAt":"2026-11-09T10:04:27.0059369+00:00","error":null,"lastVerifiedAt":"2026-11-09T12:02:17.0901763+00:00","snapshotPublishedAt":"2026-11-09T09:33:10+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null}]}