CVE-2025-39734
Revert "fs/ntfs3: Replace inode_trylock with inode_lock"
MEDIUM 5.5
At a glance
- Source
- NVD
- EPSS
- EPSS 0.15 % · percentile 4 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- Linux
- NVD status
- Analyzed
Description
In the Linux kernel, the following vulnerability has been resolved: Revert "fs/ntfs3: Replace inode_trylock with inode_lock" This reverts commit 69505fe98f198ee813898cbcaf6770949636430b. Initially, conditional lock acquisition was removed to fix an xfstest bug that was observed during internal testing. The deadlock reported by syzbot is resolved by reintroducing conditional acquisition. The xfstest bug no longer occurs on kernel version 6.16-rc1 during internal testing. I assume that changes in other modules may have contributed to this.
References
- https://git.kernel.org/stable/c/bec8109f957a6e193e52d1728799994c8005ca83
- https://git.kernel.org/stable/c/1903a6c1f2818154f6bc87bceaaecafa92b6ac5c
- https://git.kernel.org/stable/c/a936be9b5f51c4d23f66fb673e9068c6b08104a4
- https://git.kernel.org/stable/c/b356ee013a79e7e3147bfe065de376706c5d2ee9
- https://git.kernel.org/stable/c/7ce6f83ca9d52c9245b7a017466fc4baa1241b0b
- https://git.kernel.org/stable/c/bd20733746263acaaf2a21881665db27ee4303d5
- https://git.kernel.org/stable/c/a49f0abd8959048af18c6c690b065eb0d65b2d21
- https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | MEDIUM 5.5 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H | NVD · nvd@nist.gov (Primary) |
European references
- ENISA EUVD · EUVD-2025-31496
- GCVE · GCVE-0-2025-39734
CERT-FR advisories
- CERTFR-2026-AVI-0246 — Multiples vulnérabilités dans le noyau Linux d'Ubuntu · cert.ssi.gouv.fr
- CERTFR-2026-AVI-0227 — Multiples vulnérabilités dans le noyau Linux d'Ubuntu · cert.ssi.gouv.fr
- CERTFR-2026-AVI-0218 — Multiples vulnérabilités dans les produits VMware · cert.ssi.gouv.fr
- CERTFR-2026-AVI-0194 — Multiples vulnérabilités dans le noyau Linux d'Ubuntu · cert.ssi.gouv.fr
- CERTFR-2026-AVI-0169 — Multiples vulnérabilités dans le noyau Linux d'Ubuntu · cert.ssi.gouv.fr
- CERTFR-2025-AVI-1135 — Multiples vulnérabilités dans le noyau Linux d'Ubuntu · cert.ssi.gouv.fr
- CERTFR-2025-AVI-1075 — Multiples vulnérabilités dans le noyau Linux d'Ubuntu · cert.ssi.gouv.fr
- CERTFR-2025-AVI-1050 — Multiples vulnérabilités dans le noyau Linux d'Ubuntu · cert.ssi.gouv.fr
- CERTFR-2025-AVI-0894 — Multiples vulnérabilités dans le noyau Linux de Debian LTS · cert.ssi.gouv.fr
Affected configurations (NVD CPE)
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 5.15.165 < 5.15.190cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 6.1.103 < 6.1.148cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 6.6.44 < 6.6.102cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 6.10.3 < 6.12.42cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 6.13 < 6.15.10cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 6.16 < 6.16.1cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*
Affected products
| Product | Versions |
|---|---|
| Linux · Linux | affected e3e3b3eb54feaf6400800812c8d0f95a7213923d < bec8109f957a6e193e52d1728799994c8005ca83 ; affected 7a498fc945080bccc25fdc36f1d663798441158b < 1903a6c1f2818154f6bc87bceaaecafa92b6ac5c ; affected 53173e3865acb06f3e86c703696510c12fecc612 < a936be9b5f51c4d23f66fb673e9068c6b08104a4 ; affected 69505fe98f198ee813898cbcaf6770949636430b < b356ee013a79e7e3147bfe065de376706c5d2ee9 ; affected 69505fe98f198ee813898cbcaf6770949636430b < 7ce6f83ca9d52c9245b7a017466fc4baa1241b0b ; affected 69505fe98f198ee813898cbcaf6770949636430b < bd20733746263acaaf2a21881665db27ee4303d5 |
| Linux · Linux | affected 6.11 ; unaffected 0 < 6.11 ; unaffected 5.15.190 ≤ 5.15.* ; unaffected 6.1.148 ≤ 6.1.* ; unaffected 6.6.102 ≤ 6.6.* ; unaffected 6.12.42 ≤ 6.12.* |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |