CVE-2025-40007 (GCVE-0-2025-40007)

Vulnerability from cvelistv5 – Published: 2025-10-20 15:26 – Updated: 2025-10-20 15:26
VLAI?
Title
netfs: fix reference leak
Summary
In the Linux kernel, the following vulnerability has been resolved: netfs: fix reference leak Commit 20d72b00ca81 ("netfs: Fix the request's work item to not require a ref") modified netfs_alloc_request() to initialize the reference counter to 2 instead of 1. The rationale was that the requet's "work" would release the second reference after completion (via netfs_{read,write}_collection_worker()). That works most of the time if all goes well. However, it leaks this additional reference if the request is released before the I/O operation has been submitted: the error code path only decrements the reference counter once and the work item will never be queued because there will never be a completion. This has caused outages of our whole server cluster today because tasks were blocked in netfs_wait_for_outstanding_io(), leading to deadlocks in Ceph (another bug that I will address soon in another patch). This was caused by a netfs_pgpriv2_begin_copy_to_cache() call which failed in fscache_begin_write_operation(). The leaked netfs_io_request was never completed, leaving `netfs_inode.io_count` with a positive value forever. All of this is super-fragile code. Finding out which code paths will lead to an eventual completion and which do not is hard to see: - Some functions like netfs_create_write_req() allocate a request, but will never submit any I/O. - netfs_unbuffered_read_iter_locked() calls netfs_unbuffered_read() and then netfs_put_request(); however, netfs_unbuffered_read() can also fail early before submitting the I/O request, therefore another netfs_put_request() call must be added there. A rule of thumb is that functions that return a `netfs_io_request` do not submit I/O, and all of their callers must be checked. For my taste, the whole netfs code needs an overhaul to make reference counting easier to understand and less fragile & obscure. But to fix this bug here and now and produce a patch that is adequate for a stable backport, I tried a minimal approach that quickly frees the request object upon early failure. I decided against adding a second netfs_put_request() each time because that would cause code duplication which obscures the code further. Instead, I added the function netfs_put_failed_request() which frees such a failed request synchronously under the assumption that the reference count is exactly 2 (as initially set by netfs_alloc_request() and never touched), verified by a WARN_ON_ONCE(). It then deinitializes the request object (without going through the "cleanup_work" indirection) and frees the allocation (with RCU protection to protect against concurrent access by netfs_requests_seq_start()). All code paths that fail early have been changed to call netfs_put_failed_request() instead of netfs_put_request(). Additionally, I have added a netfs_put_request() call to netfs_unbuffered_read() as explained above because the netfs_put_failed_request() approach does not work there.
Severity ?
No CVSS data available.
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: 20d72b00ca814d748f5663484e5c53bb2bf37a3a , < 8df142e93098b4531fadb5dfcf93087649f570b3 (git)
Affected: 20d72b00ca814d748f5663484e5c53bb2bf37a3a , < 4d428dca252c858bfac691c31fa95d26cd008706 (git)
Affected: 1a8360c2eed3b292ed654c2ac61b09de4a80e298 (git)
Create a notification for this product.
    Linux Linux Affected: 6.16
Unaffected: 0 , < 6.16 (semver)
Unaffected: 6.16.10 , ≤ 6.16.* (semver)
Unaffected: 6.17 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/netfs/buffered_read.c",
            "fs/netfs/direct_read.c",
            "fs/netfs/direct_write.c",
            "fs/netfs/internal.h",
            "fs/netfs/objects.c",
            "fs/netfs/read_pgpriv2.c",
            "fs/netfs/read_single.c",
            "fs/netfs/write_issue.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "8df142e93098b4531fadb5dfcf93087649f570b3",
              "status": "affected",
              "version": "20d72b00ca814d748f5663484e5c53bb2bf37a3a",
              "versionType": "git"
            },
            {
              "lessThan": "4d428dca252c858bfac691c31fa95d26cd008706",
              "status": "affected",
              "version": "20d72b00ca814d748f5663484e5c53bb2bf37a3a",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "1a8360c2eed3b292ed654c2ac61b09de4a80e298",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/netfs/buffered_read.c",
            "fs/netfs/direct_read.c",
            "fs/netfs/direct_write.c",
            "fs/netfs/internal.h",
            "fs/netfs/objects.c",
            "fs/netfs/read_pgpriv2.c",
            "fs/netfs/read_single.c",
            "fs/netfs/write_issue.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.16"
            },
            {
              "lessThan": "6.16",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.16.*",
              "status": "unaffected",
              "version": "6.16.10",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.17",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.16.10",
                  "versionStartIncluding": "6.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.17",
                  "versionStartIncluding": "6.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.15.3",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfs: fix reference leak\n\nCommit 20d72b00ca81 (\"netfs: Fix the request\u0027s work item to not\nrequire a ref\") modified netfs_alloc_request() to initialize the\nreference counter to 2 instead of 1.  The rationale was that the\nrequet\u0027s \"work\" would release the second reference after completion\n(via netfs_{read,write}_collection_worker()).  That works most of the\ntime if all goes well.\n\nHowever, it leaks this additional reference if the request is released\nbefore the I/O operation has been submitted: the error code path only\ndecrements the reference counter once and the work item will never be\nqueued because there will never be a completion.\n\nThis has caused outages of our whole server cluster today because\ntasks were blocked in netfs_wait_for_outstanding_io(), leading to\ndeadlocks in Ceph (another bug that I will address soon in another\npatch).  This was caused by a netfs_pgpriv2_begin_copy_to_cache() call\nwhich failed in fscache_begin_write_operation().  The leaked\nnetfs_io_request was never completed, leaving `netfs_inode.io_count`\nwith a positive value forever.\n\nAll of this is super-fragile code.  Finding out which code paths will\nlead to an eventual completion and which do not is hard to see:\n\n- Some functions like netfs_create_write_req() allocate a request, but\n  will never submit any I/O.\n\n- netfs_unbuffered_read_iter_locked() calls netfs_unbuffered_read()\n  and then netfs_put_request(); however, netfs_unbuffered_read() can\n  also fail early before submitting the I/O request, therefore another\n  netfs_put_request() call must be added there.\n\nA rule of thumb is that functions that return a `netfs_io_request` do\nnot submit I/O, and all of their callers must be checked.\n\nFor my taste, the whole netfs code needs an overhaul to make reference\ncounting easier to understand and less fragile \u0026 obscure.  But to fix\nthis bug here and now and produce a patch that is adequate for a\nstable backport, I tried a minimal approach that quickly frees the\nrequest object upon early failure.\n\nI decided against adding a second netfs_put_request() each time\nbecause that would cause code duplication which obscures the code\nfurther.  Instead, I added the function netfs_put_failed_request()\nwhich frees such a failed request synchronously under the assumption\nthat the reference count is exactly 2 (as initially set by\nnetfs_alloc_request() and never touched), verified by a\nWARN_ON_ONCE().  It then deinitializes the request object (without\ngoing through the \"cleanup_work\" indirection) and frees the allocation\n(with RCU protection to protect against concurrent access by\nnetfs_requests_seq_start()).\n\nAll code paths that fail early have been changed to call\nnetfs_put_failed_request() instead of netfs_put_request().\nAdditionally, I have added a netfs_put_request() call to\nnetfs_unbuffered_read() as explained above because the\nnetfs_put_failed_request() approach does not work there."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-10-20T15:26:53.880Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/8df142e93098b4531fadb5dfcf93087649f570b3"
        },
        {
          "url": "https://git.kernel.org/stable/c/4d428dca252c858bfac691c31fa95d26cd008706"
        }
      ],
      "title": "netfs: fix reference leak",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-40007",
    "datePublished": "2025-10-20T15:26:53.880Z",
    "dateReserved": "2025-04-16T07:20:57.151Z",
    "dateUpdated": "2025-10-20T15:26:53.880Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-40007\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-10-20T16:15:37.357\",\"lastModified\":\"2025-10-21T19:31:25.450\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nnetfs: fix reference leak\\n\\nCommit 20d72b00ca81 (\\\"netfs: Fix the request\u0027s work item to not\\nrequire a ref\\\") modified netfs_alloc_request() to initialize the\\nreference counter to 2 instead of 1.  The rationale was that the\\nrequet\u0027s \\\"work\\\" would release the second reference after completion\\n(via netfs_{read,write}_collection_worker()).  That works most of the\\ntime if all goes well.\\n\\nHowever, it leaks this additional reference if the request is released\\nbefore the I/O operation has been submitted: the error code path only\\ndecrements the reference counter once and the work item will never be\\nqueued because there will never be a completion.\\n\\nThis has caused outages of our whole server cluster today because\\ntasks were blocked in netfs_wait_for_outstanding_io(), leading to\\ndeadlocks in Ceph (another bug that I will address soon in another\\npatch).  This was caused by a netfs_pgpriv2_begin_copy_to_cache() call\\nwhich failed in fscache_begin_write_operation().  The leaked\\nnetfs_io_request was never completed, leaving `netfs_inode.io_count`\\nwith a positive value forever.\\n\\nAll of this is super-fragile code.  Finding out which code paths will\\nlead to an eventual completion and which do not is hard to see:\\n\\n- Some functions like netfs_create_write_req() allocate a request, but\\n  will never submit any I/O.\\n\\n- netfs_unbuffered_read_iter_locked() calls netfs_unbuffered_read()\\n  and then netfs_put_request(); however, netfs_unbuffered_read() can\\n  also fail early before submitting the I/O request, therefore another\\n  netfs_put_request() call must be added there.\\n\\nA rule of thumb is that functions that return a `netfs_io_request` do\\nnot submit I/O, and all of their callers must be checked.\\n\\nFor my taste, the whole netfs code needs an overhaul to make reference\\ncounting easier to understand and less fragile \u0026 obscure.  But to fix\\nthis bug here and now and produce a patch that is adequate for a\\nstable backport, I tried a minimal approach that quickly frees the\\nrequest object upon early failure.\\n\\nI decided against adding a second netfs_put_request() each time\\nbecause that would cause code duplication which obscures the code\\nfurther.  Instead, I added the function netfs_put_failed_request()\\nwhich frees such a failed request synchronously under the assumption\\nthat the reference count is exactly 2 (as initially set by\\nnetfs_alloc_request() and never touched), verified by a\\nWARN_ON_ONCE().  It then deinitializes the request object (without\\ngoing through the \\\"cleanup_work\\\" indirection) and frees the allocation\\n(with RCU protection to protect against concurrent access by\\nnetfs_requests_seq_start()).\\n\\nAll code paths that fail early have been changed to call\\nnetfs_put_failed_request() instead of netfs_put_request().\\nAdditionally, I have added a netfs_put_request() call to\\nnetfs_unbuffered_read() as explained above because the\\nnetfs_put_failed_request() approach does not work there.\"}],\"metrics\":{},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/4d428dca252c858bfac691c31fa95d26cd008706\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/8df142e93098b4531fadb5dfcf93087649f570b3\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.