CVE-2025-37999

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

fs/erofs/fileio: call erofs_onlinefolio_split() after bio_add_folio()

If bio_add_folio() fails (because it is full),

erofs_fileio_scan_folio() needs to submit the I/O request via

erofs_fileio_rq_submit() and allocate a new I/O request with an empty

`struct bio`. Then it retries the bio_add_folio() call.

However, at this point, erofs_onlinefolio_split() has already been

called which increments `folio->private`; the retry will call

erofs_onlinefolio_split() again, but there will never be a matching

erofs_onlinefolio_end() call. This leaves the folio locked forever

and all waiters will be stuck in folio_wait_bit_common().

This bug has been added by commit ce63cb62d794 ("erofs: support

unencoded inodes for fileio"), but was practically unreachable because

there was room for 256 folios in the `struct bio` - until commit

9f74ae8c9ac9 ("erofs: shorten bvecs[] for file-backed mounts") which

reduced the array capacity to

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References