CVE-2025-38139
A critical bug in the Linux kernel’s network filesystem code can cause a kernel crash when writing data. The flaw occurs when retrying a write operation and incorrectly resetting the subrequest iterator, leading to memory corruption.
An official fix is available, so this entry is kept for 30 days and then removed automatically.
Who is affected
Linux kernel, all versions before the patch that fixes netfs_retry_write_stream. Typical users: Linux system administrators and users running affected kernel versions.
Real-world impact
An attacker could trigger a kernel crash, potentially leading to denial of service or, if they can execute code, arbitrary code execution with kernel privileges.
Why this severity
The CVSS score of 9.8 reflects the vulnerability’s high impact: it allows an attacker to cause a kernel crash (availability) and potentially execute arbitrary code (confidentiality, integrity). The attack requires no special privileges and can be performed remotely.
What to do about it
- 01Upgrade the Linux kernel to a version that includes the netfs_retry_write_stream fix (e.g., the latest stable release).
- 02Reboot the system after the kernel upgrade.
NVD-referenced vendor advisory
Timeline
- Jul 3, 2025 · Jul 3, 2025PublishedDisclosed and added to the National Vulnerability Database.
- Jul 30, 2026 · 7d agoAdvisory updatedThe NVD record was last revised.
- Jul 30, 2026 · 6d agoOfficial fix availableA vendor patch or mitigation now exists — see the remediation steps above.