{"id":"CVE-2025-39878","revision":"b3a0b79ea57e4fd491f1174d24bcdc63","records":[{"revision":"b3a0b79ea57e4fd491f1174d24bcdc63","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2025-39878","aliases":[],"title":"ceph: fix crash after fscrypt_encrypt_pagecache_blocks() error","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nceph: fix crash after fscrypt_encrypt_pagecache_blocks() error\n\nThe function move_dirty_folio_in_page_array() was created by commit\nce80b76dd327 (\"ceph: introduce ceph_process_folio_batch() method\") by\nmoving code from ceph_writepages_start() to this function.\n\nThis new function is supposed to return an error code which is checked\nby the caller (now ceph_process_folio_batch()), and on error, the\ncaller invokes redirty_page_for_writepage() and then breaks from the\nloop.\n\nHowever, the refactoring commit has gone wrong, and it by accident, it\nalways returns 0 (= success) because it first NULLs the pointer and\nthen returns PTR_ERR(NULL) which is always 0.  This means errors are\nsilently ignored, leaving NULL entries in the page array, which may\nlater crash the kernel.\n\nThe simple solution is to call PTR_ERR() before clearing the pointer.","state":0,"publishedAt":"2025-09-23T06:00:48.85+00:00","modifiedAt":"2026-10-21T12:37:31.515+00:00","affected":[{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"fs/ceph/addr.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"0f2b2b7cacf888229cec19126e6791b11fb35f32\",\n                            \"lessThan\": \"4a918f04cf97b2436a8dfe5cb51bb33f8e8831f4\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"ce80b76dd32764cc914975777e058d4fae4f0ea0\",\n                            \"lessThan\": \"dd1616ecbea920d228c56729461ed223cc501425\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"ce80b76dd32764cc914975777e058d4fae4f0ea0\",\n                            \"lessThan\": \"249e0a47cdb46bb9eae65511c569044bd8698d7d\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"affected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"fs/ceph/addr.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"6.15\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"0\",\n                            \"lessThan\": \"6.15\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.16.8\",\n                            \"lessThanOrEqual\": \"6.16.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.17\",\n                            \"lessThanOrEqual\": \"*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"original_commit_for_fix\"\n                        }\n                    ]\n                }"}],"metrics":[],"references":["https://git.kernel.org/stable/c/4a918f04cf97b2436a8dfe5cb51bb33f8e8831f4","https://git.kernel.org/stable/c/dd1616ecbea920d228c56729461ed223cc501425","https://git.kernel.org/stable/c/249e0a47cdb46bb9eae65511c569044bd8698d7d"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2025-39878","license":"CVE Program Terms of Use","key":"cve-program:CVE-2025-39878","identifiers":["CVE-2025-39878"]},"retained":false,"historicalAffected":[]}],"coverage":[]}