linux-cve-announce - CVE-2025-39835: xfs: do not propagate ENODATA disk errors into xattr code

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <2025091658-CVE-2025-39835-6f82@gregkh>
Date: Tue, 16 Sep 2025 15:09:03 +0200
From: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
To: linux-cve-announce@...r.kernel.org
Cc: Greg Kroah-Hartman <gregkh@...nel.org>
Subject: CVE-2025-39835: xfs: do not propagate ENODATA disk errors into xattr code

From: Greg Kroah-Hartman <gregkh@...nel.org>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

xfs: do not propagate ENODATA disk errors into xattr code

ENODATA (aka ENOATTR) has a very specific meaning in the xfs xattr code;
namely, that the requested attribute name could not be found.

However, a medium error from disk may also return ENODATA. At best,
this medium error may escape to userspace as "attribute not found"
when in fact it's an IO (disk) error.

At worst, we may oops in xfs_attr_leaf_get() when we do:

	error = xfs_attr_leaf_hasname(args, &bp);
	if (error == -ENOATTR)  {
		xfs_trans_brelse(args->trans, bp);
		return error;
	}

because an ENODATA/ENOATTR error from disk leaves us with a null bp,
and the xfs_trans_brelse will then null-deref it.

As discussed on the list, we really need to modify the lower level
IO functions to trap all disk errors and ensure that we don't let
unique errors like this leak up into higher xfs functions - many
like this should be remapped to EIO.

However, this patch directly addresses a reported bug in the xattr
code, and should be safe to backport to stable kernels. A larger-scope
patch to handle more unique errors at lower levels can follow later.

(Note, prior to 07120f1abdff we did not oops, but we did return the
wrong error code to userspace.)

The Linux kernel CVE team has assigned CVE-2025-39835 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 5.9 with commit 07120f1abdff80f3d1351f733661abe28d609535 and fixed in 5.10.242 with commit 157ddfb05961c68ab7d457a462822a698e4e4bf4
	Issue introduced in 5.9 with commit 07120f1abdff80f3d1351f733661abe28d609535 and fixed in 5.15.191 with commit 90bae69c2959c39912f0c2f07a9a7894f3fc49f5
	Issue introduced in 5.9 with commit 07120f1abdff80f3d1351f733661abe28d609535 and fixed in 6.1.150 with commit e358d4b6225e4c1eb208686a05e360ef8df59e07
	Issue introduced in 5.9 with commit 07120f1abdff80f3d1351f733661abe28d609535 and fixed in 6.6.104 with commit d3cc7476b89fb45b7e00874f4f56f6b928467c60
	Issue introduced in 5.9 with commit 07120f1abdff80f3d1351f733661abe28d609535 and fixed in 6.12.45 with commit dcdf36f1b67884c722abce9b8946e34ffb9f67c8
	Issue introduced in 5.9 with commit 07120f1abdff80f3d1351f733661abe28d609535 and fixed in 6.16.5 with commit 39fc2742ca14f7fbc621ce9b43bcbd00248cb9a8
	Issue introduced in 5.9 with commit 07120f1abdff80f3d1351f733661abe28d609535 and fixed in 6.17-rc4 with commit ae668cd567a6a7622bc813ee0bb61c42bed61ba7

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2025-39835
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	fs/xfs/libxfs/xfs_attr_remote.c
	fs/xfs/libxfs/xfs_da_btree.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/157ddfb05961c68ab7d457a462822a698e4e4bf4
	https://git.kernel.org/stable/c/90bae69c2959c39912f0c2f07a9a7894f3fc49f5
	https://git.kernel.org/stable/c/e358d4b6225e4c1eb208686a05e360ef8df59e07
	https://git.kernel.org/stable/c/d3cc7476b89fb45b7e00874f4f56f6b928467c60
	https://git.kernel.org/stable/c/dcdf36f1b67884c722abce9b8946e34ffb9f67c8
	https://git.kernel.org/stable/c/39fc2742ca14f7fbc621ce9b43bcbd00248cb9a8
	https://git.kernel.org/stable/c/ae668cd567a6a7622bc813ee0bb61c42bed61ba7