CVE-2025-22036: exfat: fix random stack corruption after get_block
In the Linux kernel, the following vulnerability has been resolved:
exfat: fix random stack corruption after getblock
When getblock is called with a bufferhead allocated on the stack, such as dompagereadpage, stack corruption due to bufferhead UAF may occur in the following race condition situation.
<CPU 0> <CPU 1> mpagereadfolio <<bh on stack>> dompagereadpage exfatgetblock bhread bhread getbh(bh) submitbh waitonbuffer ... endbufferreadsync endbufferreadnotouch unlockbuffer <<keep going>> ... ... ... ... <<bh is not valid out of mpagereadfolio>> . . anotherfunction <<variable A on stack>> putbh(bh) atomicdec(bh->bcount) stack corruption here
This patch returns -EAGAIN if a folio does not have buffers when bhread needs to be called. By doing this, the caller can fallback to functions like blockreadfullfolio(), create a bufferhead in the folio, and then call getblock again.
Let's do not call bhread() with on-stack bufferhead.
Other sources
In the Linux kernel, the following vulnerability has been resolved:
exfat: fix random stack corruption after getblock
When getblock is called with a bufferhead allocated on the stack, such as dompagereadpage, stack corruption due to bufferhead UAF may occur in the following race condition situation.
<CPU 0> <CPU 1> mpagereadfolio <<bh on stack>> dompagereadpage exfatgetblock bhread bhread getbh(bh) submitbh waitonbuffer ... endbufferreadsync endbufferreadnotouch unlockbuffer <<keep going>> ... ... ... ... <<bh is not valid out of mpagereadfolio>> . . anotherfunction <<variable A on stack>> putbh(bh) atomicdec(bh->bcount) stack corruption here
This patch returns -EAGAIN if a folio does not have buffers when bhread needs to be called. By doing this, the caller can fallback to functions like blockreadfullfolio(), create a bufferhead in the folio, and then call getblock again.
Let's do not call bhread() with on-stack bufferhead.
— NVD
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Apply the described kernel fix for exfat: ensure get_block/bh_read do not operate on a buffer_head allocated on the stack. Instead, create a buffer_head in the folio (e.g., like block_read_full_folio()), then call mpage_read_folio, and use put_bh(bh) after submit_bh per the patch logic to avoid buffer_head UAF and stack corruption.
Linux kernel (exfat) do not call bh_read() with an on-stack buffer_head = true
Event History
Frequently Asked Questions
What is the severity of CVE-2025-22036?
CVE-2025-22036 has been classified as a high-severity vulnerability due to the potential for stack corruption and exploitation.
How do I fix CVE-2025-22036?
To mitigate CVE-2025-22036, it is recommended to update the Linux kernel to a version where the vulnerability has been patched.
Which versions of the Linux kernel are affected by CVE-2025-22036?
CVE-2025-22036 affects Linux kernel versions from 6.8 to 6.12.23, 6.13 to 6.13.11, and 6.14 to 6.14.2.
What impacts can result from CVE-2025-22036?
Exploitation of CVE-2025-22036 can lead to possible stack corruption, resulting in system instability or crashes.
Who should be concerned about CVE-2025-22036?
System administrators and users running affected versions of the Linux kernel should prioritize addressing CVE-2025-22036.