CVE-2025-39879: 
Linux Debian vulnerability analysis and mitigation

CVE-2025-39879 is a NULL pointer dereference vulnerability in the Linux kernel's Ceph storage subsystem, specifically in the ceph_writepages_start() write path. The flaw arises because ceph_process_folio_batch() sets folio_batch entries to NULL (an illegal state), but the cleanup function ceph_shift_unused_folios_left() is no longer reliably called to remove those NULLs before folio_batch_release() is invoked, leading to a kernel crash. Affected versions include Linux kernel 6.15 through 6.16.7 and 6.17-rc1 through 6.17-rc5. It was published on September 23, 2025, with a CVSS v3.1 base score of 5.5 (Medium) (Red Hat Advisory, Red Hat Bugzilla).

The root cause is a NULL pointer dereference (CWE-476) introduced by two successive refactoring commits: ce80b76dd327 ("ceph: introduce ceph_process_folio_batch() method") moved the for loop into ceph_process_folio_batch(), making the i variable in ceph_writepages_start() no longer increment, which rendered ceph_shift_unused_folios_left() effectively unreachable. A subsequent commit 1551ec61dc55 ("ceph: introduce ceph_submit_write() method") added further preconditions that prevent the shift from occurring when ceph_process_folio_batch() fails, returns early, or when processed_in_fbatch is zero. The result is that any error path in ceph_process_folio_batch() leaves NULL entries in the folio_batch array, causing folios_put_refs() to dereference a NULL pointer and crash the kernel. Exploitation requires local access with low privileges and is triggered through Ceph write operations (Red Hat Bugzilla).

Successful exploitation causes a kernel NULL pointer dereference, crashing the system and resulting in a denial of service (DoS) condition. There is no confidentiality or integrity impact — the vulnerability is limited to availability, potentially forcing a system reboot. Systems using Ceph-backed storage (e.g., cloud infrastructure, distributed storage clusters) are at elevated risk of service disruption during write-heavy workloads (Red Hat Advisory, Red Hat Bugzilla).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of publication. The EPSS score is approximately 0.018% (0.000180), indicating very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires local, low-privileged access to a system running an affected kernel version with Ceph storage in use (Red Hat Advisory).

The fix involves always calling ceph_shift_unused_folios_left() immediately after ceph_process_folio_batch() to ensure the illegal NULL state in folio_batch is cleaned up regardless of the code path taken. Patches are available on git.kernel.org for affected stable branches (targeting versions up to 6.16.8) and are tracked in Red Hat's Bugzilla. Users should update to Linux kernel 6.16.8 or later, or apply the relevant stable patches. As a workaround, restricting local user access on systems running Ceph-backed storage can reduce exposure (Red Hat Bugzilla, Kernel Patch 1, Kernel Patch 2).