Entreprise française de cybersécurité depuis 2004
☎ 03 60 47 09 81 - info@securiteinfo.com

CVE-2025-22036

Description

In the Linux kernel, the following vulnerability has been resolved:exfat: fix random stack corruption after get_blockWhen get_block is called with a buffer_head allocated on the stack, suchas do_mpage_readpage, stack corruption due to buffer_head UAF may occur inthe following race condition situation. mpage_read_folio <> do_mpage_readpage exfat_get_block bh_read __bh_read get_bh(bh) submit_bh wait_on_buffer ... end_buffer_read_sync __end_buffer_read_notouch unlock_buffer <> ... ... ... ...<> . .another_function <> put_bh(bh) atomic_dec(bh->b_count) * stack corruption here *This patch returns -EAGAIN if a folio does not have buffers when bh_readneeds to be called. By doing this, the caller can fallback to functionslike block_read_full_folio(), create a buffer_head in the folio, and thencall get_block again.Let's do not call bh_read() with on-stack buffer_head.

CVE-2025-22036

Description

POC

Reference

Github