In the Linux kernel, the following vulnerability has been resolved:
fs: writeback: fix use-after-free in _markinode_dirty()
An use-after-free issue occurred when _markinodedirty() get the bdiwriteback that was in the progress of switching.
CPU: 1 PID: 562 Comm: systemd-random- Not tainted 6.6.56-gb4403bd46a8e #1 ...... pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : _markinodedirty+0x124/0x418 lr : _markinodedirty+0x118/0x418 sp : ffffffc08c9dbbc0 ........ Call trace: _markinodedirty+0x124/0x418 genericupdatetime+0x4c/0x60 filemodified+0xcc/0xd0 ext4bufferedwriteiter+0x58/0x124 ext4filewriteiter+0x54/0x704 vfswrite+0x1c0/0x308 ksyswrite+0x74/0x10c _arm64syswrite+0x1c/0x28 invokesyscall+0x48/0x114 el0svccommon.constprop.0+0xc0/0xe0 doel0svc+0x1c/0x28 el0svc+0x40/0xe4 el0t64synchandler+0x120/0x12c el0t64sync+0x194/0x198
Root cause is:
_markinodedirty inodeswitchwbsworkfn
spinlock(&inode->ilock); inodeattachwb lockedinodetowbandlocklist get inode->iwb spinunlock(&inode->ilock); spinlock(&wb->listlock) spinlock(&inode->ilock) inodeiolistmovelocked spinunlock(&wb->listlock) spinunlock(&inode->ilock) spinlock(&oldwb->listlock) inodedoswitchwbs spinlock(&inode->ilock) inode->iwb = newwb spinunlock(&inode->ilock) spinunlock(&oldwb->listlock) wbputmany(oldwb, nrswitched) cgwbrelease old wb released wbwakeup_delayed() accesses wb, then trigger the use-after-free issue
Fix this race condition by holding inode spinlock until wbwakeupdelayed() finished.
[
{
"deprecated": false,
"target": {
"file": "fs/fs-writeback.c",
"function": "__mark_inode_dirty"
},
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1edc2feb9c759a9883dfe81cb5ed231412d8b2e4",
"signature_version": "v1",
"id": "CVE-2025-39866-1510009a",
"digest": {
"function_hash": "99787736746310118837948134386632232475",
"length": 1741.0
}
},
{
"deprecated": false,
"target": {
"file": "fs/fs-writeback.c",
"function": "__mark_inode_dirty"
},
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b187c976111960e6e54a6b1fff724f6e3d39406c",
"signature_version": "v1",
"id": "CVE-2025-39866-458ea770",
"digest": {
"function_hash": "99787736746310118837948134386632232475",
"length": 1741.0
}
},
{
"deprecated": false,
"target": {
"file": "fs/fs-writeback.c"
},
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b187c976111960e6e54a6b1fff724f6e3d39406c",
"signature_version": "v1",
"id": "CVE-2025-39866-52e20354",
"digest": {
"threshold": 0.9,
"line_hashes": [
"318048162571236153739874963825541777717",
"120804246640176753005925301772118478348",
"266116421526045805922822011890051026414",
"96939763158758057358722692008555860230",
"107921933752821645047500774637151025404",
"231141167595999253034614678129801373358",
"43190681749025605283493283850441914210",
"189083903465400554857417212993646768290",
"193869597267481189404641898749084484859"
]
}
},
{
"deprecated": false,
"target": {
"file": "fs/fs-writeback.c"
},
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c8c14adf80bd1a6e4a1d7ee9c2a816881c26d17a",
"signature_version": "v1",
"id": "CVE-2025-39866-53826d99",
"digest": {
"threshold": 0.9,
"line_hashes": [
"318048162571236153739874963825541777717",
"120804246640176753005925301772118478348",
"266116421526045805922822011890051026414",
"96939763158758057358722692008555860230",
"107921933752821645047500774637151025404",
"231141167595999253034614678129801373358",
"43190681749025605283493283850441914210",
"189083903465400554857417212993646768290",
"193869597267481189404641898749084484859"
]
}
},
{
"deprecated": false,
"target": {
"file": "fs/fs-writeback.c"
},
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1edc2feb9c759a9883dfe81cb5ed231412d8b2e4",
"signature_version": "v1",
"id": "CVE-2025-39866-614e9251",
"digest": {
"threshold": 0.9,
"line_hashes": [
"318048162571236153739874963825541777717",
"120804246640176753005925301772118478348",
"266116421526045805922822011890051026414",
"96939763158758057358722692008555860230",
"107921933752821645047500774637151025404",
"231141167595999253034614678129801373358",
"43190681749025605283493283850441914210",
"189083903465400554857417212993646768290",
"193869597267481189404641898749084484859"
]
}
},
{
"deprecated": false,
"target": {
"file": "fs/fs-writeback.c"
},
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e63052921f1b25a836feb1500b841bff7a4a0456",
"signature_version": "v1",
"id": "CVE-2025-39866-8833a24b",
"digest": {
"threshold": 0.9,
"line_hashes": [
"318048162571236153739874963825541777717",
"120804246640176753005925301772118478348",
"266116421526045805922822011890051026414",
"96939763158758057358722692008555860230",
"107921933752821645047500774637151025404",
"231141167595999253034614678129801373358",
"43190681749025605283493283850441914210",
"189083903465400554857417212993646768290",
"193869597267481189404641898749084484859"
]
}
},
{
"deprecated": false,
"target": {
"file": "fs/fs-writeback.c",
"function": "__mark_inode_dirty"
},
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@bf89b1f87c72df79cf76203f71fbf8349cd5c9de",
"signature_version": "v1",
"id": "CVE-2025-39866-893bf114",
"digest": {
"function_hash": "99787736746310118837948134386632232475",
"length": 1741.0
}
},
{
"deprecated": false,
"target": {
"file": "fs/fs-writeback.c",
"function": "__mark_inode_dirty"
},
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e63052921f1b25a836feb1500b841bff7a4a0456",
"signature_version": "v1",
"id": "CVE-2025-39866-be855363",
"digest": {
"function_hash": "99787736746310118837948134386632232475",
"length": 1741.0
}
},
{
"deprecated": false,
"target": {
"file": "fs/fs-writeback.c",
"function": "__mark_inode_dirty"
},
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c8c14adf80bd1a6e4a1d7ee9c2a816881c26d17a",
"signature_version": "v1",
"id": "CVE-2025-39866-fa9765c0",
"digest": {
"function_hash": "99787736746310118837948134386632232475",
"length": 1741.0
}
},
{
"deprecated": false,
"target": {
"file": "fs/fs-writeback.c"
},
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@bf89b1f87c72df79cf76203f71fbf8349cd5c9de",
"signature_version": "v1",
"id": "CVE-2025-39866-fbb8b096",
"digest": {
"threshold": 0.9,
"line_hashes": [
"318048162571236153739874963825541777717",
"120804246640176753005925301772118478348",
"266116421526045805922822011890051026414",
"96939763158758057358722692008555860230",
"107921933752821645047500774637151025404",
"231141167595999253034614678129801373358",
"43190681749025605283493283850441914210",
"189083903465400554857417212993646768290",
"193869597267481189404641898749084484859"
]
}
}
]