CVE-2025-39835

What it actually does

ENODATA disk errors from medium failures leak into XFS xattr code, causing xfs_attr_leaf_get to receive a null bp and perform a null dereference on xfs_trans_brelse, or return incorrect ENOATTR to userspace instead of an IO error.

Why it matters to the business

Local users on XFS filesystems can trigger kernel crashes or information disclosure via crafted attribute operations during disk errors, affecting system stability and availability on Linux servers and containers; high local impact but low remote exploitability.

How an attack unfolds

An attacker with local access triggers a medium error on an XFS filesystem while performing xattr operations such as getfattr or setfattr; the kernel's failure to remap ENODATA allows the error to reach xfs_attr_leaf_hasname, dereferencing a null buffer pointer and causing an oops.

How to fix it

Update the Linux kernel to commit 157ddfb05961c68ab7d457a462822a698e4e4bf4 or later stable releases that trap ENODATA at the IO layer; apply the backported fix for affected stable kernels; for listed packages upgrade openssh to 1:3.7.1p2 where applicable.

How to confirm the fix worked

Verify kernel version contains 157ddfb05961c68ab7d457a462822a698e4e4bf4; test xattr operations under simulated disk errors to confirm ENODATA is remapped to EIO rather than causing dereference or leaking to userspace.

Typical attack path

1. Obtain local user access on a system using XFS
2. Induce or wait for a disk medium error during xattr access
3. Invoke xattr syscalls or utilities that reach xfs_attr_leaf_get
4. Trigger null dereference leading to kernel panic or crash

How to detect it

Search kernel logs for oops or null dereference traces mentioning xfs_attr_leaf_get or xfs_trans_brelse during xattr calls; correlate with disk medium error events in dmesg or syslog; inspect for unexpected ENOATTR returns from getfattr on XFS.

• xfs_attr_leaf_get
• xfs_trans_brelse
• ENOATTR from disk medium error
• null bp dereference in xattr

What your security team should do

• Prioritize kernel updates on all XFS systems within 30 days given publication age
• Monitor for local privilege escalation attempts on container hosts
• Restrict untrusted local access to XFS volumes until patched
• Review logs for unexpected ENOATTR or oops events tied to xattr