In the Linux kernel, the following vulnerability has been resolved:
xfs: do not propagate ENODATA disk errors into xattr code
ENODATA (aka ENOATTR) has a very specific meaning in the xfs xattr code; namely, that the requested attribute name could not be found.
However, a medium error from disk may also return ENODATA. At best, this medium error may escape to userspace as "attribute not found" when in fact it's an IO (disk) error.
At worst, we may oops in xfsattrleaf_get() when we do:
error = xfs_attr_leaf_hasname(args, &bp);
if (error == -ENOATTR) {
xfs_trans_brelse(args->trans, bp);
return error;
}
because an ENODATA/ENOATTR error from disk leaves us with a null bp, and the xfstransbrelse will then null-deref it.
As discussed on the list, we really need to modify the lower level IO functions to trap all disk errors and ensure that we don't let unique errors like this leak up into higher xfs functions - many like this should be remapped to EIO.
However, this patch directly addresses a reported bug in the xattr code, and should be safe to backport to stable kernels. A larger-scope patch to handle more unique errors at lower levels can follow later.
(Note, prior to 07120f1abdff we did not oops, but we did return the wrong error code to userspace.)
[
{
"digest": {
"function_hash": "72996059297397141834250302675148222298",
"length": 1270.0
},
"id": "CVE-2025-39835-001784f8",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@157ddfb05961c68ab7d457a462822a698e4e4bf4",
"signature_version": "v1",
"target": {
"file": "fs/xfs/libxfs/xfs_attr_remote.c",
"function": "xfs_attr_rmtval_get"
},
"deprecated": false
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"224847197407276569172666915307135758222",
"243699272735614778072821636874595422023",
"145995699413003428216528826525585126761",
"138037916735449707834029904053510496084"
]
},
"id": "CVE-2025-39835-005a4245",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e358d4b6225e4c1eb208686a05e360ef8df59e07",
"signature_version": "v1",
"target": {
"file": "fs/xfs/libxfs/xfs_attr_remote.c"
},
"deprecated": false
},
{
"digest": {
"function_hash": "4369082970497091714904876885285211126",
"length": 673.0
},
"id": "CVE-2025-39835-018692c4",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d3cc7476b89fb45b7e00874f4f56f6b928467c60",
"signature_version": "v1",
"target": {
"file": "fs/xfs/libxfs/xfs_da_btree.c",
"function": "xfs_da_read_buf"
},
"deprecated": false
},
{
"digest": {
"function_hash": "243025206782131573216484859850157324290",
"length": 726.0
},
"id": "CVE-2025-39835-05997b50",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@dcdf36f1b67884c722abce9b8946e34ffb9f67c8",
"signature_version": "v1",
"target": {
"file": "fs/xfs/libxfs/xfs_da_btree.c",
"function": "xfs_da_read_buf"
},
"deprecated": false
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"214388700961725286363993689817755689565",
"83488940776041322596670250859654963001",
"275250629386849290318185749266280642354",
"38985250901873059460166136501682024802"
]
},
"id": "CVE-2025-39835-05b6f997",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@39fc2742ca14f7fbc621ce9b43bcbd00248cb9a8",
"signature_version": "v1",
"target": {
"file": "fs/xfs/libxfs/xfs_da_btree.c"
},
"deprecated": false
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"162176477189810451492492172252759671414",
"7649576303711171628134075428791153922",
"213610881687395770451477155567971581391",
"164159455809621817219569469615259393783"
]
},
"id": "CVE-2025-39835-21395c7b",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@dcdf36f1b67884c722abce9b8946e34ffb9f67c8",
"signature_version": "v1",
"target": {
"file": "fs/xfs/libxfs/xfs_attr_remote.c"
},
"deprecated": false
},
{
"digest": {
"function_hash": "4369082970497091714904876885285211126",
"length": 673.0
},
"id": "CVE-2025-39835-2bf1cda7",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e358d4b6225e4c1eb208686a05e360ef8df59e07",
"signature_version": "v1",
"target": {
"file": "fs/xfs/libxfs/xfs_da_btree.c",
"function": "xfs_da_read_buf"
},
"deprecated": false
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"224847197407276569172666915307135758222",
"243699272735614778072821636874595422023",
"145995699413003428216528826525585126761",
"138037916735449707834029904053510496084"
]
},
"id": "CVE-2025-39835-3374134e",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d3cc7476b89fb45b7e00874f4f56f6b928467c60",
"signature_version": "v1",
"target": {
"file": "fs/xfs/libxfs/xfs_attr_remote.c"
},
"deprecated": false
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"224847197407276569172666915307135758222",
"243699272735614778072821636874595422023",
"145995699413003428216528826525585126761",
"138037916735449707834029904053510496084"
]
},
"id": "CVE-2025-39835-3be461dc",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@90bae69c2959c39912f0c2f07a9a7894f3fc49f5",
"signature_version": "v1",
"target": {
"file": "fs/xfs/libxfs/xfs_attr_remote.c"
},
"deprecated": false
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"224847197407276569172666915307135758222",
"243699272735614778072821636874595422023",
"145995699413003428216528826525585126761",
"138037916735449707834029904053510496084"
]
},
"id": "CVE-2025-39835-48783252",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@157ddfb05961c68ab7d457a462822a698e4e4bf4",
"signature_version": "v1",
"target": {
"file": "fs/xfs/libxfs/xfs_attr_remote.c"
},
"deprecated": false
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"162176477189810451492492172252759671414",
"7649576303711171628134075428791153922",
"213610881687395770451477155567971581391",
"164159455809621817219569469615259393783"
]
},
"id": "CVE-2025-39835-5b0c06ae",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@39fc2742ca14f7fbc621ce9b43bcbd00248cb9a8",
"signature_version": "v1",
"target": {
"file": "fs/xfs/libxfs/xfs_attr_remote.c"
},
"deprecated": false
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"214388700961725286363993689817755689565",
"83488940776041322596670250859654963001",
"275250629386849290318185749266280642354",
"38985250901873059460166136501682024802"
]
},
"id": "CVE-2025-39835-5c42818a",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@dcdf36f1b67884c722abce9b8946e34ffb9f67c8",
"signature_version": "v1",
"target": {
"file": "fs/xfs/libxfs/xfs_da_btree.c"
},
"deprecated": false
},
{
"digest": {
"function_hash": "242454136717658375286665448744046138468",
"length": 1372.0
},
"id": "CVE-2025-39835-6a9c0272",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ae668cd567a6a7622bc813ee0bb61c42bed61ba7",
"signature_version": "v1",
"target": {
"file": "fs/xfs/libxfs/xfs_attr_remote.c",
"function": "xfs_attr_rmtval_get"
},
"deprecated": false
},
{
"digest": {
"function_hash": "4369082970497091714904876885285211126",
"length": 673.0
},
"id": "CVE-2025-39835-6ba5f849",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@90bae69c2959c39912f0c2f07a9a7894f3fc49f5",
"signature_version": "v1",
"target": {
"file": "fs/xfs/libxfs/xfs_da_btree.c",
"function": "xfs_da_read_buf"
},
"deprecated": false
},
{
"digest": {
"function_hash": "242454136717658375286665448744046138468",
"length": 1372.0
},
"id": "CVE-2025-39835-6e1b666d",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@dcdf36f1b67884c722abce9b8946e34ffb9f67c8",
"signature_version": "v1",
"target": {
"file": "fs/xfs/libxfs/xfs_attr_remote.c",
"function": "xfs_attr_rmtval_get"
},
"deprecated": false
},
{
"digest": {
"function_hash": "72996059297397141834250302675148222298",
"length": 1270.0
},
"id": "CVE-2025-39835-6fdcb9b3",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e358d4b6225e4c1eb208686a05e360ef8df59e07",
"signature_version": "v1",
"target": {
"file": "fs/xfs/libxfs/xfs_attr_remote.c",
"function": "xfs_attr_rmtval_get"
},
"deprecated": false
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"214388700961725286363993689817755689565",
"83488940776041322596670250859654963001",
"275250629386849290318185749266280642354",
"38985250901873059460166136501682024802"
]
},
"id": "CVE-2025-39835-818e8de3",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ae668cd567a6a7622bc813ee0bb61c42bed61ba7",
"signature_version": "v1",
"target": {
"file": "fs/xfs/libxfs/xfs_da_btree.c"
},
"deprecated": false
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"216933776005428778659555947820674038310",
"53753519207591802574061817428633439611",
"66945427313005375627893529443075927599",
"284601239502301741897269537442904065585"
]
},
"id": "CVE-2025-39835-896dca7f",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@90bae69c2959c39912f0c2f07a9a7894f3fc49f5",
"signature_version": "v1",
"target": {
"file": "fs/xfs/libxfs/xfs_da_btree.c"
},
"deprecated": false
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"162176477189810451492492172252759671414",
"7649576303711171628134075428791153922",
"213610881687395770451477155567971581391",
"164159455809621817219569469615259393783"
]
},
"id": "CVE-2025-39835-8f724f73",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ae668cd567a6a7622bc813ee0bb61c42bed61ba7",
"signature_version": "v1",
"target": {
"file": "fs/xfs/libxfs/xfs_attr_remote.c"
},
"deprecated": false
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"216933776005428778659555947820674038310",
"53753519207591802574061817428633439611",
"66945427313005375627893529443075927599",
"284601239502301741897269537442904065585"
]
},
"id": "CVE-2025-39835-aa0274e2",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d3cc7476b89fb45b7e00874f4f56f6b928467c60",
"signature_version": "v1",
"target": {
"file": "fs/xfs/libxfs/xfs_da_btree.c"
},
"deprecated": false
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"216933776005428778659555947820674038310",
"53753519207591802574061817428633439611",
"66945427313005375627893529443075927599",
"284601239502301741897269537442904065585"
]
},
"id": "CVE-2025-39835-b919d348",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e358d4b6225e4c1eb208686a05e360ef8df59e07",
"signature_version": "v1",
"target": {
"file": "fs/xfs/libxfs/xfs_da_btree.c"
},
"deprecated": false
},
{
"digest": {
"function_hash": "4369082970497091714904876885285211126",
"length": 673.0
},
"id": "CVE-2025-39835-bf06944b",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@157ddfb05961c68ab7d457a462822a698e4e4bf4",
"signature_version": "v1",
"target": {
"file": "fs/xfs/libxfs/xfs_da_btree.c",
"function": "xfs_da_read_buf"
},
"deprecated": false
},
{
"digest": {
"function_hash": "243025206782131573216484859850157324290",
"length": 726.0
},
"id": "CVE-2025-39835-c0233529",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@39fc2742ca14f7fbc621ce9b43bcbd00248cb9a8",
"signature_version": "v1",
"target": {
"file": "fs/xfs/libxfs/xfs_da_btree.c",
"function": "xfs_da_read_buf"
},
"deprecated": false
},
{
"digest": {
"function_hash": "243025206782131573216484859850157324290",
"length": 726.0
},
"id": "CVE-2025-39835-c2373878",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ae668cd567a6a7622bc813ee0bb61c42bed61ba7",
"signature_version": "v1",
"target": {
"file": "fs/xfs/libxfs/xfs_da_btree.c",
"function": "xfs_da_read_buf"
},
"deprecated": false
},
{
"digest": {
"function_hash": "242454136717658375286665448744046138468",
"length": 1372.0
},
"id": "CVE-2025-39835-df9476ad",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@39fc2742ca14f7fbc621ce9b43bcbd00248cb9a8",
"signature_version": "v1",
"target": {
"file": "fs/xfs/libxfs/xfs_attr_remote.c",
"function": "xfs_attr_rmtval_get"
},
"deprecated": false
},
{
"digest": {
"function_hash": "72996059297397141834250302675148222298",
"length": 1270.0
},
"id": "CVE-2025-39835-e2d0db39",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@90bae69c2959c39912f0c2f07a9a7894f3fc49f5",
"signature_version": "v1",
"target": {
"file": "fs/xfs/libxfs/xfs_attr_remote.c",
"function": "xfs_attr_rmtval_get"
},
"deprecated": false
},
{
"digest": {
"function_hash": "72996059297397141834250302675148222298",
"length": 1270.0
},
"id": "CVE-2025-39835-faf23207",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d3cc7476b89fb45b7e00874f4f56f6b928467c60",
"signature_version": "v1",
"target": {
"file": "fs/xfs/libxfs/xfs_attr_remote.c",
"function": "xfs_attr_rmtval_get"
},
"deprecated": false
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"216933776005428778659555947820674038310",
"53753519207591802574061817428633439611",
"66945427313005375627893529443075927599",
"284601239502301741897269537442904065585"
]
},
"id": "CVE-2025-39835-fb1f5f1e",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@157ddfb05961c68ab7d457a462822a698e4e4bf4",
"signature_version": "v1",
"target": {
"file": "fs/xfs/libxfs/xfs_da_btree.c"
},
"deprecated": false
}
]