CVE-2025-39866

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> fs: writeback: fix use-after-free in __mark_inode_dirty()<br /> <br /> An use-after-free issue occurred when __mark_inode_dirty() get the<br /> bdi_writeback that was in the progress of switching.<br /> <br /> CPU: 1 PID: 562 Comm: systemd-random- Not tainted 6.6.56-gb4403bd46a8e #1<br /> ......<br /> pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)<br /> pc : __mark_inode_dirty+0x124/0x418<br /> lr : __mark_inode_dirty+0x118/0x418<br /> sp : ffffffc08c9dbbc0<br /> ........<br /> Call trace:<br /> __mark_inode_dirty+0x124/0x418<br /> generic_update_time+0x4c/0x60<br /> file_modified+0xcc/0xd0<br /> ext4_buffered_write_iter+0x58/0x124<br /> ext4_file_write_iter+0x54/0x704<br /> vfs_write+0x1c0/0x308<br /> ksys_write+0x74/0x10c<br /> __arm64_sys_write+0x1c/0x28<br /> invoke_syscall+0x48/0x114<br /> el0_svc_common.constprop.0+0xc0/0xe0<br /> do_el0_svc+0x1c/0x28<br /> el0_svc+0x40/0xe4<br /> el0t_64_sync_handler+0x120/0x12c<br /> el0t_64_sync+0x194/0x198<br /> <br /> Root cause is:<br /> <br /> systemd-random-seed kworker<br /> ----------------------------------------------------------------------<br /> ___mark_inode_dirty inode_switch_wbs_work_fn<br /> <br /> spin_lock(&amp;inode-&gt;i_lock);<br /> inode_attach_wb<br /> locked_inode_to_wb_and_lock_list<br /> get inode-&gt;i_wb<br /> spin_unlock(&amp;inode-&gt;i_lock);<br /> spin_lock(&amp;wb-&gt;list_lock)<br /> spin_lock(&amp;inode-&gt;i_lock)<br /> inode_io_list_move_locked<br /> spin_unlock(&amp;wb-&gt;list_lock)<br /> spin_unlock(&amp;inode-&gt;i_lock)<br /> spin_lock(&amp;old_wb-&gt;list_lock)<br /> inode_do_switch_wbs<br /> spin_lock(&amp;inode-&gt;i_lock)<br /> inode-&gt;i_wb = new_wb<br /> spin_unlock(&amp;inode-&gt;i_lock)<br /> spin_unlock(&amp;old_wb-&gt;list_lock)<br /> wb_put_many(old_wb, nr_switched)<br /> cgwb_release<br /> old wb released<br /> wb_wakeup_delayed() accesses wb,<br /> then trigger the use-after-free<br /> issue<br /> <br /> Fix this race condition by holding inode spinlock until<br /> wb_wakeup_delayed() finished.