CVE-2025-39878 ceph: fix crash after fscrypt_encrypt_pagecache_blocks() error
A logic error in the Ceph filesystem code causes kernel crashes when encryption errors occur, leading to denial of service.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-39878?
CVE-2025-39878 is a medium-severity vulnerability in Linux kernel, published on 23 Sep 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
ceph: fix crash after fscrypt_encrypt_pagecache_blocks() error
The function move_dirty_folio_in_page_array() was created by commit ce80b76dd327 ("ceph: introduce ceph_process_folio_batch() method") by moving code from ceph_writepages_start() to this function.
This new function is supposed to return an error code which is checked by the caller (now ceph_process_folio_batch()), and on error, the caller invokes redirty_page_for_writepage() and then breaks from the loop.
However, the refactoring commit has gone wrong, and it by accident, it always returns 0 (= success) because it first NULLs the pointer and then returns PTR_ERR(NULL) which is always 0. This means errors are silently ignored, leaving NULL entries in the page array, which may later crash the kernel.
The simple solution is to call PTR_ERR() before clearing the pointer.
Weakness: CWE-476
Which versions are affected by CVE-2025-39878?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2025-39878?
Apply the vendor's patch.
Is CVE-2025-39878 being exploited?
There is no known exploitation of CVE-2025-39878 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as BELL-CVE-2025-39878, DEBIAN-CVE-2025-39878, GHSA-wmpp-p439-v4x7, UBUNTU-CVE-2025-39878.