Vulnerability · CVE-2025-39879
In the Linux kernel, the following vulnerability has been resolved: ceph: always call ceph_shift_unused_folios_left() The function ceph_process_folio_batch() sets folio_batch entri
Published Sep 23, 2025 · catalog updated Oct 21, 2026 · Linux Linux
Check if you run it
No confirmed exploitation is on record for CVE-2025-39879. EPSS is 0.15%. Act only if a listed version of Linux Linux is installed.
Gaps on this record
- No vendor fix or required action is stored. Compare the linked advisory before you change production.
- Severity
- Medium5.5
- Known exploitation
- Not in CISA/VulnCheck KEV
- EPSS
- 0.15%
- Remediation
- Version ranges on file
- Affected products
- cpe linux/linux kernel · vendor Linux Linux ce80b76dd32764cc914975777e058d4fae4f0ea0 <cce7c15faaac79b532a07ed6ab8332280ad83762
In the Linux kernel, the following vulnerability has been resolved: ceph: always call ceph_shift_unused_folios_left() The function ceph_process_folio_batch() sets folio_batch entries to NULL, which is an illegal state. Before folio_batch_release() crashes due to this API violation, the function ceph_shift_unused_folios_left() is supposed to remove those NULLs from the array. However, since commit ce80b76dd327 ("ceph: introduce ceph_process_folio_batch() method"), this shifting doesn't happen anymore because the "for" loop got moved to ceph_process_folio_batch(), and now the variable that remains in ceph_writepages_start() doesn't get incremented anymore, making the shifting effectively unreachable much of the time. Later, commit 1551ec61dc55 ("ceph: introduce ceph_submit_write() method") added more preconditions for doing the shift, replacing the check (with something that is still just as broken): - if ceph_process_folio_batch() fails, shifting never happens - if ceph_move_dirty_page_in_page_array() was never called (because ceph_process_folio_batch() has returned early for some of various reasons), shifting never happens - if is zero (because ceph_process_folio_batch() has returned early for some of the reasons mentioned above or because ceph_move_dirty_page_in_page_array() has failed), shifting never happens Since those two commits, any problem in ceph_process_folio_batch() could crash the kernel, e.g. this way: BUG: kernel NULL pointer dereference, address: 0000000000000034 #PF: supervisor write access in kernel mode #PF: error_code(0x0002) - not-present page PGD 0 P4D 0 Oops: Oops: 0002 [#1] SMP NOPTI CPU: 172 UID: 0 PID: 2342707 Comm: kworker/u778:8 Not tainted 6.15.10-cm4all1-es #714 NONE Hardware name: Dell Inc. PowerEdge R7615/0G9DHV, BIOS 1.6.10 12/08/2023 Workqueue: writeback wb_workfn (flush-ceph-1) RIP: 0010:folios_put_refs+0x85/0x140 Code: 83 c5 01 39 e8 7e 76 48 63 c5 49 8b 5c c4 08 b8 01 00 00 00 4d 85 ed 74 05 41 8b 44 ad 00 48 8b 15 b0 > RSP: 0018:
Are you affected?
Enter the version you run. The result uses only the ranges stored on this record.
The check returns affected, not affected, or incomplete. It does not guess a version that is missing from the record.
- cpe linux/linux kernel6.17
- cpe linux/linux kernel< 6.16.8
- vendor Linux Linux ce80b76dd32764cc914975777e058d4fae4f0ea0 <cce7c15faaac79b532a07ed6ab8332280ad83762ce80b76dd32764cc914975777e058d4fae4f0ea0 <cce7c15faaac79b532a07ed6ab8332280ad83762
How to fix CVE-2025-39879
Recommended remediation
Affected version ranges suggest a fixed boundary. Verify against the vendor advisory for your release.
Official advisories
What to do
Three questions, each answered from this record only. Confirm the vendor advisory before you patch.
Should you patch?
No confirmed exploitation is on record for CVE-2025-39879. EPSS is 0.15%. Act only if a listed version of Linux Linux is installed.
Which versions are affected?
Compare what you have installed with linux/linux kernel 6.17; linux/linux kernel < 6.16.8; Linux Linux ce80b76dd32764cc914975777e058d4fae4f0ea0 <cce7c15faaac79b532a07ed6ab8332280ad83762 ce80b76dd32764cc914975777e058d4fae4f0ea0 <cce7c15faaac79b532a07ed6ab8332280ad83762. Compare the installed version with the linked vendor advisory before you change production.
What should an analyst verify?
CWE-476: NULL Pointer Dereference. EPSS 0.15%. There is no CISA KEV listing. No Exploit-DB or Metasploit reference is linked. Use the source links for the original advisory.
Code
The project this record applies to. Exploit listings stay in References.
Timeline
Detection, updates, and resolution for this record.
Sep 23, 2025 · NIST NVD
Detected
In the Linux kernel, the following vulnerability has been resolved: ceph: always call ceph_shift_unused_folios_left() The function ceph_process_folio_batch() sets folio_batch entries to NULL, which is an illegal state. Before folio_batch_release() crashes due to this API violation, the function ceph_shift_unused_folios_left() is supposed to remove those NULLs from the array. However, since commit
Oct 21, 2026 · NIST NVD
Updated
In the Linux kernel, the following vulnerability has been resolved: ceph: always call ceph_shift_unused_folios_left() The function ceph_process_folio_batch() sets folio_batch entries to NULL, which is an illegal state. Before folio_batch_release() crashes due to this API violation, the function ceph_shift_unused_folios_left() is supposed to remove those NULLs from the array. However, since commit
Sources
- CVE.orgVulnerability recordCVE-2025-39879
Official CVE identifier
cve.org - FIRST EPSSExploitation probabilityCVE-2025-39879
30-day exploitation probability 0.15%
first.org - EUVDVulnerability recordEUVD-2025-30860
In the Linux kernel, the following vulnerability has been resolved: ceph: always call ceph_shift_unused_folios_left() The function ceph_process_folio_batch() sets folio_batch entries to NULL, which is an illegal state. Before folio_batch_release() crashes due to this API violatio
euvd.enisa.europa.eu - NIST NVDVulnerability recordCVE-2025-39879
In the Linux kernel, the following vulnerability has been resolved: ceph: always call ceph_shift_unused_folios_left() The function ceph_process_folio_batch() sets folio_batch entries to NULL, which is an illegal state. Before folio_batch_release() crashes due to this API viola
nvd.nist.gov
References
Freshness
Last verified in this catalog Oct 23, 2026. Significant claims (KEV, EPSS, CVSS, affected ranges) come from the source rows above — open the original publisher for the authoritative advisory.