CVE-2025-39734 Revert "fs/ntfs3: Replace inode_trylock with inode_lock"

What is CVE-2025-39734?

CVE-2025-39734 is a medium-severity vulnerability in Debian Debian Linux, published on 7 Sep 2025. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

In the Linux kernel, the following vulnerability has been resolved:

Revert "fs/ntfs3: Replace inode_trylock with inode_lock"

This reverts commit 69505fe98f198ee813898cbcaf6770949636430b.

Initially, conditional lock acquisition was removed to fix an xfstest bug that was observed during internal testing. The deadlock reported by syzbot is resolved by reintroducing conditional acquisition. The xfstest bug no longer occurs on kernel version 6.16-rc1 during internal testing. I assume that changes in other modules may have contributed to this.

Which versions are affected by CVE-2025-39734?

It affects 2 products.

Products include Debian Debian Linux, Linux kernel.

How do I fix CVE-2025-39734?

Apply the vendor's patch.

Is CVE-2025-39734 being exploited?

There is no known exploitation of CVE-2025-39734 in the wild and no public exploit code.

Other vulnerabilities in Debian Debian Linux

• CVE-2015-3306 ProFTPD Improper Access Control Exploited Critical 10.0
• CVE-2025-49113 RoundCube Webmail Deserialization of Untrusted Data Exploited Critical 9.9
• CVE-2026-24061 GNU InetUtils Argument Injection Exploited Critical 9.8
• CVE-2025-39682 Linux Kernel Improper Check for Unusual or Exceptional Conditions Exploited Critical 9.8
• CVE-2024-9680 Mozilla Firefox Use-After-Free Exploited Critical 9.8

All Debian Debian Linux vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as BELL-CVE-2025-39734, DEBIAN-CVE-2025-39734, GHSA-wh65-53hg-mxpv, ROOT-OS-UBUNTU-2204-CVE-2025-39734, ROOT-OS-UBUNTU-2404-CVE-2025-39734, UBUNTU-CVE-2025-39734.